Loss Prevention Bulletin

Improving process safety by sharing experience

Disaster
1916 Issue 251, October 2016

Anniversaries
The great explosion
of 1916
1986
Fire and explosion of
LPG tanks at Feyzin
1966

Seveso –
40 years on
1986
Chernobyl –
1976 30 years on

The Sandoz
warehouse fire –
30 years on

The Challenger
Space Shuttle disaster

Risk and safety

management of
ammonium nitrate
fertilizers
1921 1986

LPBcover251.indd 1 30/09/2016 14:25

 IChe
m

E
Safet

re
y

t
n
Ce

IChemE safety training

October – December 2016
IChemE offers a range of training courses to help you, Fundamentals of Process Safety
10–14 Oct, Melbourne, Australia
your staff and your organisation improve safety and www.icheme.org/fpsmel
reduce risk. Comprehensive Explosion Science
11–12 Oct, London, UK
All IChemE training courses can be run in-company. www.icheme.org/ces
Email courses@icheme.org for a quotation. Gas Explosion Hazards on LNG Facilities
13–14 Oct, London, UK
Visit www.icheme.org/courses to view all IChemE www.icheme.org/lng
training courses. Layer of Protection Analysis (LOPA)
25–26 Oct, Boksburg, South Africa
Register for any course at www.icheme.org/booking www.icheme.org/lopasa
Fundamentals of Nuclear Safety
31 Oct–4 Nov, Preston, UK
www.icheme.org/fns
Fundamentals of Process Safety Management
7–11 Nov, Boksburg, South Africa
www.icheme.org/fpsm
Layer of Protection Analysis (LOPA)
8–9 Nov, Cork, Ireland
www.icheme.org/lopa
Human Factors in Health and Safety
16–17 Nov, Melbourne, Australia
www.icheme.org/humanfactors
Layer of Protection Analysis (LOPA)
17–18 Nov, Singapore
www.icheme.org/lopasing
HAZOP Study, Leadership and Management
21–23 Nov, London, UK
www.icheme.org/hazopstudy
HAZOP Study for Team Leaders and Team Members
29 Nov–2 Dec, Manchester, UK
www.icheme.org/hazopteam
Fundamentals of Process Safety
5–9 Dec, Reading, UK
www.icheme.org/fps
Inherent Safety in Design and Operation Development
6–8 Dec, Brisbane, Australia
www.icheme.org/isaus
Process Safety Performance Indicators and PSM Auditing
13–14 Dec, London, UK
www.icheme.org/pspi
Human Factors in Design
C0493_16

14–15 Dec, Edinburgh, UK

www.icheme.org/humanfactors4

C0493_16 tce_FP AD_Saftey September.indd 1 30/09/2016 14:34

lpbinfopage251.indd 37 30/09/2016 14:35


Contents
Loss Prevention Bulletin
Articles and case studies
from around the world
Issue 251, October 2016
Editor: Tracey Donaldson
Publications Director:
Claudia Flavell-While
Subscriptions: Hannah Rourke
Designer: Alex Revell
Copyright: The Institution of Chemical
Engineers 2016. A Registered Charity in
England and Wales and a charity registered
in Scotland (SCO39661)
ISSN 0260-9576/16
The information included in lpb is given in
good faith but without any liability on the
part of IChemE
Photocopying
lpb and the individual articles are protected
by copyright. Users are permitted to
make single photocopies of single articles
for personal use as allowed by national
copyright laws. For all other photocopying
permission must be obtained and a fee
paid. Permissions may be sought directly
from the Institution of Chemical Engineers,
or users may clear permissions and make
payments through their local Reproduction
Rights Organisation. In the UK apply
to the Copyright Licensing agency
Rapid Clearance Service (CLARCS), 90
Tottenham Court Road, London, W1P
0LP (Phone: 020 7631 5500). In the USA
apply to the Copyright Clearance Center
(CCC), 222 Rosewood Drive, Danvers, MA
01923 (Phone: (978) 7508400, Fax: (978)
7504744).
Multiple copying of the contents of
this publication without permission is
always illegal.
Institution of Chemical Engineers
Davis Building, Railway Terrace,
Rugby, Warks, CV21 3HQ, UK
Tel: +44 (0) 1788 578214
Fax: +44 (0) 1788 560833
Email: tdonaldson@icheme.org
or journals@icheme.org
www.icheme.org
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
contents251.indd 2
Loss Prevention Bulletin 251 October 2016 | 1
2 Editorial
4 News in brief
6 The great explosion of
1916
Phillip Carson describes a huge
explosion at an explosives
manufacturing site in Faversham,
UK, during World War I that
resulted in the deaths of 108
people.
11 Fire and explosion of LPG
tanks at Feyzin, France
Adrian Bunn and Mark Hailwood
highlight the factors behind
the uncontrolled release from a
propane storage sphere, which
ultimately resulted in a series of
BLEVEs.
14 Seveso – 40 years on
Mark Hailwood outlines the
circumstances surrounding a
release of toxic chemicals, the
lessons learned and similar, more
recent incidents involving out-of-
control exothermic reactions.
18 Chernobyl – 30 years on
Fiona Macleod revisits the
Chernobyl nuclear disaster of
30 years ago and highlights the
lessons that are still applicable to
the wider process industries.
Cover photo of burnt out storage spheres, Feyzin is courtesy of Collection
Bibliothèque municipale de Lyon, Fonds Georges Vermard, P0702 B02 07 618 00001
Seveso photo courtesy of Roche
24 The Sandoz warehouse
fire – 30 years on
Ivan Vince examines the legacy of
the Sandoz fire in terms of storage
of chemicals in warehouses,
emergency response to major fires
and incidents with transboundary
consequences.
26 The Challenger Space
Shuttle disaster
John Wilkinson reviews the
Challenger Space Shuttle disaster
of 1986 in terms of the technical
and immediate causes, with a
particular focus on the contributing
organisational factors.
32 Risk and safety
management of
ammonium nitrate
fertilizers
Zsuzsanna Gyenes analyses
some of the major disasters in
the ammonium nitrate fertilizer
industry (including Oppau, 95
years ago, and Toulouse, 15 years
ago) to emphasise the importance
of remembering and learning from
past mistakes.
30/09/2016 14:27
 2 | Loss Prevention Bulletin 251 October 2016
Editorial
Major accidents of the past – what have,
and haven’t, we learnt?
This year, 2016, sees the 350th anniversary of the Great
Fire of London. Since then urban building codes, fire
protection requirements and firefighting techniques and
technology are very different. Lessons indeed have been
learned. Large-scale fire in towns and cities, which were
commonplace in mediaeval and renaissance Europe,
appear to be a thing of the past in the industrialised Europe
of today — although it should not be forgotten that the
Great Fire of Chicago, IL, USA occurred in 1871.
Anniversaries are important for commemorating
events that have taken place; for recalling the past and
for reflecting on their significance. As such, 2016 marks
a number of significant anniversaries of important major
accidents:
100 years Faversham, UK
50 years Feyzin, France
40 years Seveso, Italy
30 years Schweizerhalle, Basel, Switzerland (Sandoz)
30 years Chernobyl, USSR (now Ukraine)
30 years Challenger Space Shuttle, USA
15 Years Toulouse, France
(together with 95 years Oppau, Germany)
These are well known events, which are covered in their
own individual articles in this anniversary edition.
However there are other less familiar accidents which
should also not be forgotten.
• Manfredonia, Italy, 1976
The explosion of a scrubbing tower for the synthesis
of ammonia at the ANIC petrochemical plant led to
the release of several tons of potassium carbonate and
bicarbonate solution containing arsenic trioxide. One
hundred and fifty people were admitted to hospital
for arsenic poisoning. The symptoms were greater
amongst the inhabitants of the town of Manfredonia
than amongst the factory workers. As with the Seveso
incident in the same year, this incident was one of the
motivating events leading to the development of the
European directives on the control of major accident
hazards.
• Danvers, MA, USA, 2006
The vapour cloud explosion and subsequent fire at an
editorial.indd 2
ink and paint manufacturer destroyed the facility and
heavily damaged dozens of homes and businesses.
Twenty-four homes and businesses were completely
destroyed. The accident was caused by a complete
disregard for fundamental controls to manage
flammable liquids safely. There was also inadequate
inspection and enforcement by the local authorities.
• Syracuse, Italy, 2006
A leak due to corrosion in a pipe transporting crude
oil from the tank farm to the process field ignited,
impacting the other pipes in the pipe bundle which
contained a variety of chemical products. Some of the
pipes suffered a BLEVE and the accident led to the
hospitalisation of ten firefighters. Major causal factors
were the lack of maintenance and inspection together
with the poor design of the pipe bundle, which meant
that there was inappropriate separation between the
pipes, leading to difficulties in identifying and shutting
down the pipes. As well as hydrocarbons, there
was also high pressure steam and firefighting water
transferred in this bundle.
• Evangelos Florakis Naval Base, Cyprus, 2011
The explosion of 98 containers of explosives which
had been stored for 2½ years in the sun was the worst
peacetime military accident recorded on the island.
The explosives had been confiscated in 2009 but not
disposed of, despite protests by concerned citizens.
The explosion killed thirteen people, including six
fire-fighters, and injured 62. The explosion severely
damaged hundreds of nearby buildings including
the largest electrical power station which supplied
over half of the electricity for the island. The costs of
the explosion were estimated to be just over 10% of
Cyprus’ GDP.
This is a small selection of incidents to indicate that there
is still much to be learned and that very often the same key
factors are listed amongst the causes:
• inadequate design;
• poor identification of hazards and appropriate
measures to manage the risks;
• poor maintenance and inspection;
• inadequate considerations to human factors and safety
management;
• inadequate inspection and enforcement by public
authorities.
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:11
 Loss Prevention Bulletin 248 April 2016 | 3

This anniversary edition is expected to perform a number

of roles. Firstly, by way of a reminder, it brings together
the information on a number of important accidents and
thus can be used as a teaching or training aid, in particular
for those who have become involved in the process safety
world since these accidents took place. Secondly, it provides
an opportunity to review current practices. Reoccurrences
indicate that the lessons from the “milestone events” have Iqbal Essa
not been learned by all sections of the chemical processing Chairman,
and handling community, or have simply been forgotten. In Loss Prevention Panel
particular, exothermic chemical reactions are still running
out of control with significant impact on workforce and
the surrounding communities, and accidents involving the
storage of ammonium nitrate, in particular as fertilizers,
leads to enormous devastation and numerous fatalities.
This edition of LPB is not just a historic review, but also an
opportunity to take stock and assess whether the lessons
really have been learned and the appropriate measures
taken. The LPB editorial panel also hopes to enable the
fraternity within the chemical and allied industries to Mark Hailwood
recognise that we all have a very important role to play in LUBW Landesanstalt für
preventing accidents and saving lives. This is to ensure that Umwelt, Messungen und
those who sadly lost their lives rest in peace. Naturschutz

We have now launched our

NEW and improved IChemE shop
You will find all of IChemE associated publications
available to buy here including:

Books

Forms of contract

Training resources

Conference proceedings

Salary surveys

BP Process Safety Series

IChemE members
Take a look today www.icheme.org/shop
15% discount

© Institution of Chemical Engineers

0260-9576/16/$17.63
1444_16 Shop advert tce HP.indd 1 + 0.00 16/08/2016 16:55

editorial.indd 3 30/09/2016 13:11

 4 | Loss Prevention Bulletin 251 October 2016

News in brief...

Initial results revealed in

Florida explosion
Preliminary results have been released
by US safety officials investigating an
explosion that killed one worker at an
Airgas production facility in Florida on 28
August.
The US Chemical Safety Board (CSB)
said the explosion involved nitrous oxide
tanks in the loading bay, where the incident
is said to have taken place.
Vanessa Sutherland, chair of CSB offered
“condolences to the family suffering this
tragic loss”, adding that “the CSB’s accident
investigation will determine the root cause
Eight firefighters killed in
of this fatal incident.”
The Florida State Fire Marshal reported
Moscow warehouse fire
that there was a nitrous oxide holding tank
Eight firefighters have lost their lives while extinguishing a fire at a warehouse in
and two tankers involved and that the
Moscow.
focus of the investigation was to determine
if the explosion originated with the holding Rescuers found the bodies in the remains of a large warehouse that was
tank and tankers, or started elsewhere and engulfed by fire late on Thursday 22 September.
spread to them. The fire covered an area of 4,000 square meters and caused a 1,500 square
Airgas makes nitrous oxide using gases meter section of the building’s roof to collapse. It is understood that the victims had
supplied by the nearby plant operated by been conducting a search inside the building when its roof collapsed.
performance materials specialist Ascend. Earlier, they had managed to lead to safety more than 100 workers at the
The company said its facility may have warehouse where plastic items and other goods were stored. The fire was
sustained some damage as result of the extinguished early in the morning on 23 September and a search is continuing at
explosion; however it did not report any the site in Golyanovo, north-east Moscow.
fatalities or injuries. Firefighters prevented the explosion of 30 cylinders of household gas in the
The investigation will be handed over warehouse, as well as discharging 67kg (148lb) of ammonium from a compressor
to the US Occupational Safety & Health facility, the emergency ministry also said, quoted by Tass news agency.
Administration (OSHA). Airgas has been There are suspicions that radiators had been left on, overwhelming the building’s
subject to 37 inspections by the federal electricity circuit.
body over the last five years resulting in 22 This is the latest deadly inferno to hit the Russian capital, where safety standards
citations from 11 of the inspections. are often low.
Air Liquid completed its US$13.4bn On 27 August, a fire at a Moscow printing house in Moscow killed three Russian
purchase of Airgas in May. citizens and 14 Kyrgyz migrant workers.

Four killed in Chinese MDI unit explosion

At least four people have been killed by an explosion at a
600,000 t/y methylene di-phenylene isocyanate (MDI) unit
owned by Wanhua Chemical in Yantai, China.
According to reports, the incident occurred on 20
September when the company was shutting down the plant
for scheduled maintenance. The explosion hospitalised a total
of eight people, with four of them dying of their injuries.
The scheduled month-long maintenance at the unit will
likely be extended and further details will only be confirmed
after the incident investigations are complete.
Wanhua Chemical’s 750,000 t/y propane dehydrogenation
(PDH) and 240,000 t/y propylene oxide (PO) 800,000 t/y
methyl tertiary butyl ether (MTBE) production in Yantai
were not affected.
China has suffered a series of chemicals-related explosions
in recent times, most notably the August 2015 Tianjin blast
that killed a total of 165 people. Nine workers were killed
in an explosion at a chemical plant in Shandong Province
in October 2015, and 21 were killed at a coal power station
explosion last month.
Greenpeace said in a statement today that the incident in
Yantai now adds to a total of 232 chemicals-related incidents
that have occurred in China this year from January to
August, an average of 29 per month. The environmental
group says the incidents have caused a total of 199 deaths
and 400 injuries.

© Institution of Chemical Engineers

0260-9576/16/$17.63 + 0.00

251newslpb.indd 4 30/09/2016 13:19

 Loss Prevention Bulletin 251 October 2016 | 5

Six killed in NW China

factory blast
Six workers were killed and one
is missing after an explosion at a
chemical plant in northwest China’s
Qinghai Province.
The explosion occurred on 18
September in a dust collection device
at a cement production line belonging

Valero Energy fined to Qinghai Salt Lake Haina Chemical

Company when 26 workers were on
site, said Liu Yunzhou, head of the
following serious accident administration commission of Ganhe
Industrial Park in the Xining economic

at Pembroke Refinery
and technological development zone.
Two workers were killed instantly
in this explosion and a further twelve
were injured. Four of the injured
Valero Energy UK Limited has been fined £400, 000 following a serious accident at its
workers later died in hospital. The
Pembroke Refinery.
other eight were treated and are
The Court heard how, on 05 March 2012, an access tower walkway that provided described as stable.
gangway access to a stationary tanker vessel had dropped 3.5 metres, causing the
A search is underway for a missing
operator to be trapped by a slack wire rope. He suffered fractures and lacerations to
worker, while the cause of the
both legs and a dislocated knee as a result.
accident is being investigated.
The HSE investigation found multiple failings leading up to the incident including:
The company started production
• failure to carry out a sufficient risk assessment of the use and operation of the in 2013 with a daily capacity of 2,500
access tower, with the result that the dangers of jamming, slack cable, and tonnes of cement.
personnel accessing the walkway without engaging the scotching pin were neither
identified or addressed and the hierarchy of risk control was not applied Saudi Aramco fire injures
• failure to provide adequate information, instruction and training to employees as to eight workers
the safe use and operation of the access tower State-owned oil company Saudi
• failure to carry out adequate investigations into the previous and related incidents Aramco reported eight workers have
of September 2011, February 2011 and, in particular, August 2010 been injured as a result of a fire at
• failure to review the check-list risk assessment in light of those incidents its oil terminal facility in Ras Tanura,
• failure to act on the recommendations of their inspection contractor, particularly in Saudi Arabia.
respect of the jamming problem and the absence of any access gate interlock and The company said in a statement
ignored comments on one report that there was a ‘’potential fatal accident waiting that the incident occurred on 20
to happen’’. September at around 09:00 (local
time). The company also reported
• failure to install any means of detection or prevention of slack cable in the
that the injured, including six
mechanism
contractors and two employees, were
• failure to detect that the access tower was neither CE marked, nor subject to a receiving medical treatment.
Declaration of Conformity, as required.
Aramco said it will conduct a full
Valero Energy UK Limited (previously known as Chevron), of Pembroke Refinery, investigation to determine the cause
Pembrokeshire, pleaded guilty to a single charge of breaching Section 2(1) of the of the fire.
Health and Safety at Work etc Act 1974 at a previous hearing. It was fined £400,000 Oil and gas operations at the
and ordered to pay costs of £60,614. 550,000 bbl/d terminal were not
Speaking after the hearing, the HSE inspector said: “It was particularly disappointing impacted as a result of the fire.
to find that although the company knew there had been problems with the operation In January 2014, three workers
of the access tower the company had failed to investigate these properly and had relied were killed on an oil rig belonging
on changes to instructions, rather than taking action to modify the defective hardware, to Saudi Aramco which sank in the
as required by the hierarchy of risk control. Persian Gulf.
“This was even more surprising in view of the fact that the company operates a major Aramco said it will release
hazard refinery site where you would expect such problems to be taken more seriously additional information as it becomes
and effectively investigated, with suitable corrective actions implemented.” available.

© Institution of Chemical Engineers

0260-9576/16/$17.63 + 0.00

251newslpb.indd 5 30/09/2016 13:19

 6 | Loss Prevention Bulletin 251 October 2016
Incident
The great explosion of 1916
Phillip Carson
Summary
The main industrial uses of ammonium nitrate are in
explosives and in agriculture as a high-nitrogen fertiliser.
Many industrial accidents involving ammonium nitrate
have been described in LPB; but this paper focuses on
an industrial accident 100 years ago in the UK explosives
industry. On 2 April 1916 a fire and explosion at a
munitions factory on the Kent marshes killed 108 people,
injured 97, and caused extensive on-site damage. The
explosion was heard over 80km away. The initial fire and
explosion involved ammonium nitrate and TNT. Domino
effects affected other munitions all being prepared
urgently for the war effort. The following description leans
heavily on the sources listed in the bibliography.
Keywords: Explosion, explosives, domino effect
Introduction
Gunpowder, established in medieval times, remained the
principle propellant for military purposes up to WW1. It
comprises a mixture of carbon, sulphur and potassium nitrate.
The Kent marshes proved an ideal location for the gunpowder
industry because:
• The streams could be dammed at intervals to provide
power for watermills;
• The land was well suited for growing alder and willow as a
source of charcoal;
• The creek could be used for shipping in sulphur and
transporting out finished product;
• Of the close proximity of the arsenals in London and the
naval ports on the south coast from where it could be
loaded for use or export.
As a result, the Home Works gunpowder mill was established
at the head of Faversham creek in the 16th century. The Oare
Works was developed towards the end of the 17th century
and a third opened in 1787 known as the Marsh Works, built
by the British government approximately 1km north-west of
Faversham to augment output at its Home Works. This also
had access to the sea via Oare Creek. The more dangerous
operations were transferred from the Home Works to the
Marsh works following an explosion.
The industry continued to expand and diversify. Guncotton
(and its successors) were most suited to the Marsh plant since
it was more remote from towns and was first manufactured
under licence at the Marsh Works in 1847. Because the
faversham16.indd 6
process was poorly understood a serious explosion resulted
in 21 fatalities (only ten of whose bodies could be identified)
and the factory subsequently shutdown. Guncotton was not
made again in Faversham until 1873, when the Cotton Powder
Company (CPC), independent of the gunpowder mills, opened
on a remote virgin site about 4km northwest of the town centre
alongside the Swale, a deep-water channel dividing mainland
Kent from the Isle of Sheppey. Deliveries of raw materials
(cotton waste and sulphuric and nitric acids) and despatch of
guncotton could readily be made by water.
The explosives archipelago continued to develop and by the
turn of the century, the CPC site at Uplees became one of the
largest works in Britain producing 35 types of explosive. Cordite
(a mixture of nitroglycerine and guncotton) soon became the
main propellant for the British army and navy but the material
proved somewhat uncontrollable. By the onset of the war, the
main high-explosive used in British shells was based on picric
acid (Lyddite) which was superseded by trinitrotoluene (TNT).
In 1912, the Explosives Loading Company (ELC) joined the
CPC at its western end specifically for filling shells with TNT
(see Figure 1). The outbreak of WW1 created a vast, urgent
demand for high explosives, met chiefly by the manufacture of
amatol comprising 60% ammonium nitrate and 40% TNT, or 80%
ammonium nitrate and 20% TNT mixtures. Since ammonium
nitrate (AN) was cheaper than TNT its inclusion “stretched”
the TNT and provided an internal source of oxygen. Following
the “shell crisis” in 1915, the need for munitions became ever
urgent and the Prime Minister established the Ministry of
Munitions to control all explosives factories by coordination of
production and distribution of munitions.
The Uplees site
The ELC plant was established in 1912 under an amending
licence granted to the CPC to fill charges with TNT for shells,
torpedoes, and mines. However, management also used
Amatol. The entire site was complex with about 200 workers
and comprising hundreds of buildings including processing
plants, stores, offices, mess rooms, power houses, etc., the
majority being of light construction. Most of the CPC factory
was built on a floating crust above the marsh but magazines
were on more solid ground built into the hill and screened
by mounds. Buildings were linked by a tramway. The ELC
was the smaller company with around 30 buildings, almost all
of wooden construction with no mounds because each was
separated from others by approximately 60m. Because of the
explosion risk, the special safety arrangements reportedly
included:
• No metal buttons were allowed on garments — buttons
were all made of wood.
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:12

Figure 1 – Faversham explosives factories
ELC=Explosives Loading Company
CPC=Cotton Powder Company
• Women were not allowed metal hairpins or grips and had
to have their hair tied up in a net.
• No pockets on overalls in which items could be kept were
allowed.
• No pipes, matches or cigarettes were allowed into
the works. These had to be put into pigeon holes by
employees as they arrived for work.
• Tramway rails were made of wood close to buildings.
• Horses had brass horseshoes instead of steel to reduce the
risk of sparks.
• Buildings were constructed of wood and well-spaced out.
No metal nails were used.
• Security precautions included a military guard of 128 men
and 24 patrolmen for the two factory sites. The CPC had
its own part-time fire brigade, plenty of hydrants and hoses
and a pump always at the ready to raise extra water. The
ELC had only one four-man pump, 100 or so chemical
extinguishers and a supply of fire buckets. Water was
available from the dykes. High pressure mains water had
been laid up to the factory and the hydrants were ready for
installation but contractors had failed to deliver the pumps.
On 31 March 1916, H.M. Inspector of Explosives (Major
Cooper-Key) undertook an unannounced inspection of ELC. In
order to meet the nation’s demand the Ministry of Munitions
had stocked the factory with levels of raw materials far beyond
the plant’s production capabilities, despite complaints from
management. About 40 tonnes of AN and 60 tonnes of TNT
passed into the factory each week. Building No 833 contained
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
faversham16.indd 7
Loss Prevention Bulletin 251 October 2016 | 7
stocks of AN plus 150 tonnes of TNT; an additional 50 tonnes
load of TNT had recently been received for which there was
no storage accommodation and it was therefore stacked in the
open outside building 833. The TNT was packed in linen sacks
inside the wooden crates. Empty AN barrels and TNT sacks
had accumulated in spaces between offices, production units
and boiler houses. He noted the absence of hydrants and fire
buckets in various ELC buildings; the nearest fire-brigade was
in Faversham. Nevertheless, the inspector concluded that he
was satisfied with the general conditions, recognising the need
for urgent production to meet government expectations.
The accident
Just after noon on Sunday 2 April 1916 it was noticed that
some empty linen sacks leaning against the matchboard wall
of building 833 had ignited. The alarm was raised immediately
and the assistant manager took charge and attempted to
extinguish the fire. Men with buckets formed a chain to the
nearest dyke but the action proved futile and the building
was well alight when the manager arrived. Problems were
encountered in gathering sufficient fire hoses across the site to
reach ELC buildings from CPC hydrants, and firefighters were
unable to approach the buildings because of the intense heat.
Three Faversham fire brigades turned out but were unable to
reach the site in a timely manner through the narrow country
lanes. Building 833 became a lost cause and the men agreed to
move cases of TNT to a safe distance in an attempt to prevent
fire escalation to other buildings including the CPC cordite
plant. They tried to remove cases from within the building
but were prevented by smoke and so concentrated on crates
knowledge and
lying around three sides of the outside walls. The building
competence
was burning fiercely and the bulk of AN was alight. Fire trucks
inflamed 35m away and sparks spread to other buildings.
During the fire when a fire officer asked the deputy plant
manager if there was any danger that the store of AN and TNT
could explode he was reassured that it would only burn. For
engineering
and design
over an hour water was poured over the fire to no avail and the
manager gave the order for everyone to evacuate. At 14:20,
during the evacuation, the contents of building 833 detonated,
followed immediately by explosion of the washing/filtering
houses of the nitroglycerine plant, 110m away. Explosions of
systems and
procedures
two further buildings followed. Five buildings were destroyed
without trace, leaving behind craters some 10m wide and
4 – 6m deep (see Figure 2). All buildings of light construction
within a radius of 200m of the epicentre of the initial fire were
demolished and in total over 25 buildings belonging to the ELC
were destroyed. The extent of the destruction is illustrated by
examples shown in Figure 3. The human toll amounted to 108
deaths (including the entire works fire brigade) and 97 injuries.
As the explosion occurred on a Sunday, no women were at
work. The bodies of seven victims were never found and
70 of the corpses were buried in a mass grave at Faversham
Cemetery on 6 April with the Archbishop of Canterbury in
attendance. Letters of sympathy were received from the King
and Queen.
The explosion was heard across the Thames estuary and as
far away as Norwich and Great Yarmouth. In Southend-on-Sea,
culture
domestic windows and two large plate-glass shop windows
were broken. This was the British explosives industry’s worst
industrial accident: others around this time included the
30/09/2016 13:12
 8 | Loss Prevention Bulletin 251 October 2016
explosion at the Barnbow shell-filling factory in Leeds on 5th
Dec 1916 which resulted in 35 women losing their lives and
many injuries.
Investigation
A few days after his unannounced inspection of ELC, Major
Cooper-Key returned to the site this time to investigate the
accident. His report puts the casualties at the time as 106,
of whom 20 were CPC employees and four were military
guards. Another source suggests all but five victims (who were
members of the military) were employees helping with the
emergency, or spectators, despite being warned to leave. The
inspector confirmed the location of the initial explosion and
suggested possible sources of ignition as cigarettes, sabotage,
spontaneous ignition, or sparks from the powerhouse chimney.
After giving reasons for dismissing the first three, he concluded
that sparks were the most likely source. The three flues from
the powerhouse were each fitted with a spark-catcher but
they were of dubious efficiency and the wind was blowing
almost directly from the boiler house towards the heap of
bags just 15m away. Also, on the night before the accident,
two patrolmen reported extinguishing a fire from this source
between the boiler house and TNT store.
The report focussed on the vast quantity of stocks on site
and concluded that had the store contained only TNT as per
the licence, it was likely the contents would have simply melted
and burned. However the amount of combined TNT and AN
was equivalent to 75 tonnes of high explosive. (A further 3000
tonnes of explosive apparently remained in unaffected sheds
after the accident suggesting the outcome could have been
even more catastrophic).
In terms of accountability, the inspector acknowledged that
management could not be completely exonerated from blame
but he was clearly sympathetic of their plight. Thus:
• In permitting high levels of hazardous materials on
site management were aware of the danger and had
complained, but were over-ridden by government officials.
(The inspector himself had raised the matter of congestion
several times with the Ministry but given the necessity of
immense scale of manufacture it was practically impossible
to maintain the orderliness and method considered so
essential in normal times);
• In departure from the conditions of the license he agreed
that rapidity of output was the first priority and that it was
extremely difficult, if not impossible, to strictly adhere to
the exact letter of the licence.
• The inspector suggests it was government officials who
either failed to recognise the risk of storing AN and TNT in
the same building or had considered the risk justified by
the urgency of national requirements.
• Attempts to fight the fire and move stocks from the scene
could have put lives at risk, but the inspector singled out
the manager and works manager for bravery including their
success in extinguishing fires on the roof of the magazine
containing 25 tonnes of TNT, thereby preventing another
explosion, which would have taken out the cordite plant.
(An inquest acquitted the managers of all blame).
Because of stocks of similar ingredients elsewhere in the
faversham16.indd 8
UK the inspector had tests performed to ascertain whether
TNT and AN together in unmixed states posed greater
explosion risk than premixed amatol. Results, however, were
inconclusive probably because of the inadequacy of the test
facilities.
The inquest recommended more efficient appliances be
installed in explosives factories but the inspector’s report
emphasised the difficulties of laying high-pressure water
mains during war and although this had not been done at the
present sites, it was due to no lack of effort by management.
As a substitute, he recommended a four-man manual pump
supplemented by fire-buckets and over 100 chemical fire
extinguishers.
Lessons learned
The Minister of Munitions set up a standing committee
to establish the causes of explosions in Government and
controlled munitions factories. In May 1916, they issued a
“secret” report making the following eight recommendations:
• Boiler-houses should be located as far as possible from
danger buildings;
• Plenty of buckets filled with water should always be
available in all buildings, and proper fire hydrants provided
where possible;
• Part-time works fire brigades to be formed and trained
by qualified firemen in use of various appliances at their
disposal;
• Accumulations of empty boxes, bags, refuse of any
flammable substances to be forbidden;
• Stocks of explosives or their ingredients for which proper
storage was unavailable but which had to be stored on
site should be placed as far away as possible from other
buildings;
• TNT and AN must never be stored together in the same
building;
• All conditions and terms of licences to be strictly adhered
to, and
• If prompt use of fire buckets or hydrants fails to extinguish
a fire at once then everyone should be withdrawn to a safe
distance.
Nowadays, additional recommendations may be expected
in terms of organisational considerations (for example, the
appointment of the Ministry of Munitions represented a
significant top-down organisational change which impacted
the risk), management responsibilities, training staff in hazards,
plant design (including boiler-houses, stores), process safety
from cradle to grave, minimising inventory of hazardous
materials, review of legislation, access for emergency services,
etc. The fire on the night before the accident was a near-miss
and was a lost opportunity to recognise the risk posed and
thereby possibly circumvent the accident. Indeed, current day
requirements are for zero tolerance to even the most minor fire
within major hazard facilities.
Conclusion
This tragic but fascinating case study illustrates the difficulty
of using hindsight to criticise human factors at times of war.
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:12

The heroic attempts to dowse the fire and salvage explosives
may be considered foolhardy nowadays, but the mentality to
fight to save the plant could be linked to the workers’ national
pride in their contribution towards the war effort. Indeed,
Lord Kitchener (The Secretary of State for War) wrote to the
company’s management in 1914 instructing the workforce on
“the importance of the government work upon which they
(were) engaged”. “I should like all engaged by your company
to know that it is fully recognised that they, in carrying out the
great work of supplying munitions of war, are doing their duty
for their King and Country, equally with those who have joined
the Army for active service in the field.” The inspector’s report
on the accident concluded that those who died at their posts
gave their lives for their country in the fullest sense in trying to
save a national disaster. Nevertheless, in the present case, this
act is also attributable to lack of training, preparedness and
provision of adequate equipment.
It is appreciated that under war conditions, time may not
allow careful process development. However, one lesson
highlighted by this accident is the need to fully understand
the physical, chemical and hazardous properties of materials
being used or formed, and of the processes adopted during
manufacture. All involved should then be trained to appreciate
these under normal and emergency conditions. At the time
of the accident the physical and physiochemical properties of
AN were poorly understood, which raised problems with its
handling, storage, and the preparation of the various mixtures
with nitro explosives, and on dealing with fires and explosions
(as illustrated by the wrong advice given by the deputy plant
manager to a fire officer). This is pivotal to the accident.
In mainland Europe, AN tended to be incorporated into nitro
explosives at or below 40% when the nitro compound could
be melted and mixed with dried AN to form a slurry which was
poured into shells. In the UK, however, when blending higher
concentrations of the cheaper AN component, problems were
encountered in forming homogenous mixtures and in the
storage and handling of bulk quantities. Large masses of AN
could set rock-like and crates frequently had to be broken-
up with pickaxes. This was eventually overcome by shipping
the salt containing small quantities of water with subsequent
drying in situ at the filling factories. It was also crucial for
the shell contents to be above a minimum density so as to
ensure complete and effective detonation, achieved by use
of hydraulic presses to compact the mass by means of rams.
This hazardous operation was housed in a separate building
surrounded by mounds to minimise the effects of possible
explosion, and the control levers and recording instrument
were operated from outside the building. Mixtures filled into
shells in a hot state tended to contract on cooling and recede
from the immediate neighbourhood of the detonator and
primer so that the fuse became ineffective. This was overcome
by redesign of the shell and modification to the method of
filling and inserting the fuse.
Whether risk assessments should result in higher levels
of acceptable risk during wartime is a debatable topic.
Production targets were driven by survival and military
success rather than solely financial profit. In general the level
of risk accepted by military personnel tends to be higher than
that acceptable to civilian operators, and the rank of the chief
inspector and that of some employees may suggest a military
culture within the industry.
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
faversham16.indd 9
Loss Prevention Bulletin 251 October 2016 | 9
Today, where the number of inspectors allow, they should
be rotated on a regular basis to avoid “regulatory capture” by
management due to over-familiarity. Also, it would be wise to
use a different inspector to investigate a significant accident
than the person providing a routine regulatory service.
Material properties
TNT
TNT, manufactured by the (usually two-stage) nitration of
toluene with a mixture of fuming nitric and sulphuric acids,
is a relatively expensive explosive. It is an oxygen deficient
explosive to which oxygen-rich substances (such as AN)
are added to enhance its explosive power and it is one of
the more stable high explosives. When pure the product is
a colourless crystalline solid at room temperature melting at
81oC and boiling at 240oC. It detonates around its boiling point
but can be distilled safely under reduced pressure. It may also
detonate when subjected to strong shock. Small, unconfined
quantities will burn quietly but sudden heating of any quantity
may cause it to detonate.
TNT may enter the body via ingestion or inhalation of dust
or fume but the main route of concern is by skin absorption.
Target organs include the blood, liver, nerves and muscles.
AN is hygroscopic and keeps the skin moist and as a result
assists the passage of TNT through the skin thereby making
amatol more dangerous than TNT alone. Over-exposure
may result in a range of adverse health effects including skin
irritation, cyanosis, atrophy of the liver, anaemia, muscular
pains, menstrual irregularities etc. and, for some workers,
the materials turned their hair, face, hands, forearm and legs
orange/yellow from jaundice earning the ladies the name
‘canary girls’. (This was also seen in WW2 but was less
prevalent due to improved occupational hygiene controls).
Ammonium nitrate
Ammonium nitrate is manufactured by the exothermic
reaction between ammonia gas and concentrated nitric acid
NH3 (gas) + HNO3 (liquid) = NH4NO3 (solid)
Ammonium nitrate is a white crystalline solid freely soluble
in water when it absorbs tremendous amounts of heat. On
heating it transforms between its many crystalline forms and
melts.
-17oC 32.1oC
Tetragonal ↔ Rhombic 1 ↔ Rhombic 2
84.2oC 125.2 oC 169.6 oC
↔ Rhombohedral ↔ Cubic ↔ Liquid
At 185–220oC it decomposes to nitrous oxide and water
vapour; the decomposition becomes violent at 250oC
NH4NO3 = 2H20 + N2O
Nitrous oxide
Nitrous oxide is a colourless gas, stable at ordinary
temperatures. However, above 600oC, it decomposes to
oxygen and nitrogen and so supports combustion of burning
substances just as vigorously as does oxygen. Whether this
had any influence on the Faversham accident is unknown.
30/09/2016 13:12
 10 | Loss Prevention Bulletin 251 October 2016
Figure 2 – Crater created by explosion of building 217 (note
man in centre)
Figure 3 – Remains of building 844
Pure AN may be locally heated to red heat without explosion
and the decomposition does not spread. It may, however,
explode violently on contact with flames or other ignition
sources and can be induced to decompose explosively by
detonation. Whilst pure AN is stable under “normal conditions”
and can be stored in bulk, stockpiles pose a fire hazard due to
its highly-oxidising properties, for example, when in contact
with hydrocarbons such as oils. Since commercial AN often
contains 1% hydrocarbon oil or 5% kaolin to prevent crystals
sticking together these mixtures decompose explosively when
heated locally and the explosion may spread throughout the
entire mass.
Cordite
Cordite is manufactured by the nitration of purified, dry,
cotton waste and the product (‘nitro-cellulose’ or ‘guncotton’)
thoroughly washed before working into a uniform very loose
state and pumped as a slurry and pressed to afford material of
50% water content (dried nitro-cellulose is dangerous to store
and easily ignites and explodes). When ready to use, dried
material is mixed with nitroglycerine into a paste to which
mineral jelly and solvent are added and worked up to dough
and extruded through orifices to form spaghetti-like cord
known as Cordite. Dried product contains 65% nitro-cellulose,
30% nitroglycerine and 5% mineral jelly.
Postscript
Both Swale-side factories closed permanently in 1919.
faversham16.indd 10
However, in 1924 a new venture, the Mining Explosives
Company, opened a factory on the east side of Faversham
Creek, not far from the site of Faversham Abbey —
hence ‘Abbey Works’. After a fatal accident in 1939, the
proprietors abandoned the manufacture of high explosives
to concentrate on making an explosive-substitute based on
a reusable steel cartridge filled with carbon dioxide. The
premises continued to be licensed under the 1875 Explosives
Act, as gunpowder was used in the initiator. Manufacture
continues today under the name Long Airdox.
All three gunpowder factories closed in 1934. ICI, then
the owners, sensed war with Germany, and realised that
Faversham would become vulnerable to air attacks or possibly
invasion. Work, staff and machinery, were transferred to
Scotland. Most of the Marsh Works was later developed for
housing and the Oare works is now a nature reserve.
The UK Explosives industry has been regulated under
the Explosives Act 1875 and its subsequent revisions until
The Manufacture and Storage of Explosives Regulations
2005, which replaced most of the 1875 Act. The most recent
legislation is the Explosives Regulations 2014.
References
1. Anon, ‘The Great Explosion, 2 April, 1916’, http://
www.faversham.org/history/Explosives/Great_
Explosion_1916
2. Anon, ‘Faversham’, http://wikishire.co.uk/wiki/
Faversham
3. Anon, ‘Anniversary of deadly gunpowder mill explosion’,
Canterbury Times, 29 March, 2013 http://www.
canterburytimes.co.uk/Anniversary-deadly-1916-
gunpowder-explosion/story-18555043-detail/story.html
4. Anon, ‘The Faversham Gunpowder Mill Explosion’
http://microsites2.segfl.org.uk/library/1233134935/
gunpowder_mill.ppt
5. Cooper-Key, A., ‘Report by HM Chief Inspector of
Explosives into the explosion at the Explosives Loading
Company Ltd at Uplees Marshes, Faversham 2 April 1916’
http://www.hse.gov.uk/archive/explosive/01240.pdf
6. Dillon, B., ‘The Great Explosion’, Penguin Books, 2015
7. KYN (Administrator), ‘Faversham Gunpowder Works –
The Great Explosion of 1916’
a) http://www.kenthistoryforum.co.uk/index.
php?topic=5923.15
b) http://www.kenthistoryforum.co.uk/index.
php?topic=5923.0
8. Levy, S.I., ‘Modern Explosives’, Sir Isaac Pitman & Sons
Ltd, 1920
9. Morgan, G.T. and Pratt, D.D., ‘British Chemical Industry’,
Edward Arnold& Co, 1938
10. Percival, A., ‘The Great Explosion at Faversham, 2nd
April, 1916’, Archaeologia Cantiana, 1984, 100, 425
http://www.kentarchaeology.org.uk/Research/Pub/
ArchCant/Vol.100%20-%201984/100-27.pdf
11. The Barnbow canaries
a) http://www.bbc.co.uk/news/entertainment-
arts-36558506
b) http://www.bbc.co.uk/programmes/p023hms0
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:12
 Loss Prevention Bulletin 251 October 2016 | 11

Incident

Fire and explosion of LPG tanks at

Feyzin, France
Adrian Bunn, Aker Solutions, UK; Mark Hailwood, LUBW, Germany
On 04 January 1966 at the Feyzin refinery in France an
Safety valve
uncontrolled release from a propane storage sphere ignited,
caused a fire that burned fiercely around the vessel and led to
a series of BLEVEs.
This disaster was the worst accident to have occurred in a
Cooling rings
petroleum or petrochemical plant in Western Europe prior to
the Flixborough disaster in 1974. Since then, many pressurized
tanks containing liquefied gases have been subject to a BLEVE.

11.0m
The hazards are now better understood, and storage spheres
are protected from fire engulfment by better design. However, Sample line
so many firefighters and emergency responders have been
killed while trying to control fire engulfed pressure vessels
that the cautious philosophy is to evacuate and take shelter
Purge line

1.75m
until the material burns itself out rather than attempting to
extinguish the fire.

The LPG storage installation Sump

Eight LPG storage spheres were positioned inside a bund with

a central sub-division which divided the bund in two groups
each made up of two propane (each 1200m³) and two butane
spheres (each 2000 m³). Each sphere was provided with fixed
Niv 100783 D
water sprays and on top of each sphere was a three-way valve

engineering
and design
3/4” RB 213G 2”RB 214 B
beneath two identical pressure relief valves. Ring for pressure text
Samples were taken from the spheres routinely every three φ2" Serie 300. Standard
TECHNIP No1300-716-2 2”
to five days for analysis. The sampling line was located on a ¾”
sampling tap positioned between two 2” purge valves which
Niv 99 630
were used to drain production residues (oily salt/hydroxide

solution) from the spheres. The purge valves were positioned
about 260 mm apart and the pipework in between was fitted
with rudimentary steam heating and lagging (see figure 1).
The accident
Early on the morning of 04 January, a product sample was due
to be taken from one of the spheres, which was being filled
by the site’s production units. Before 6:40 a.m., whilst it was
still dark, the laboratory technician entered the LPG bund to
sample the sphere. The tank had to be purged of residues
before the product sample was taken, and plant operator and a
shift fireman accompanied the technician in order to carry out
this task.
The sampling valves which branched off the purge line were
often frozen and difficult to access; therefore sampling was
regularly carried out via the purge line.
Uncontrolled releases had occurred previously under a
butane sphere in August 1964 and under a propane sphere
in February 1965. The releases were eventually brought
systems and
procedures
Figure 1 – Schematic representation of the purge valve
configuration, Source – N° 1 -  04/01/1966 -  FRANCE -
69 - FEYZIN
under control without ignition. These two incidents led to
the operating procedure for sampling being drawn up which
stipulated that the upper valve should be opened quarter-way
and then the lower valve should be progressively opened, but
never fully.
At 6:40 a.m., the operator opened two valves in series on
the bottom of the sphere in order to drain off an aqueous layer.
Firstly, he opened the lower valve half-way, then the upper
valve even further. This was the reverse sequence to that laid
down in a recently issued operating procedure.
When this operation was nearly complete, he closed the

© Institution of Chemical Engineers

0260-9576/16/$17.63 + 0.00

feyzin.indd 11 30/09/2016 13:13

 12 | Loss Prevention Bulletin 251 October 2016

upper valve and then cracked it open again. There was no

flow and he fully opened this valve. The blockage, which was
presumably a hydrate or an ice plug, suddenly cleared, and
propane gushed out, but the operator was unable to close the
upper valve because it had frozen. He did not think at once to
close the lower valve and by the time he attempted this, this
valve had also frozen open. The leaking propane splashed up
from the drain and frost burnt the operator on the face and
forearm.
The alarm was raised and steps were taken to stop traffic
on the nearby motorway. According to witnesses, a propane
vapour cloud, spread towards the road. It is believed that a car
about 160m away on a small road adjacent to the motorway
may have been the source of ignition. It was later found that its
engine was not running but its ignition was on and it may have
stalled by taking in a propane rich mixture into the air intake.
Flames appeared to flash back from the car to the sphere in a
series of jumps.
At around 7:15 a.m. the sphere was enveloped in a fierce
fire. Its pressure relief valve lifted at 7.45 a.m. and the escaping
vapour ignited. Following the ignition at the pressure relief Burnt out storage spheres, Feyzin. Courtesy of Collection
valve the firefighters stopped spraying the sphere, as they Bibliothèque municipale de Lyon, Fonds Georges Vermard,
considered the opening of the valve as positive and assumed P0702 B02 07 618 00001
that the tank would burn itself out over a period of the next two
to three hours. They then concentrated instead on cooling the
other spheres. At around 8.45 a.m. the sphere ruptured, killing
the men nearby. A wave of liquid propane was flung over the
compound wall and flying fragments cut off the legs of the next Large missiles may be projected several hundred metres. The
propane sphere, which toppled so that its relief valve began resulting flash-off and combustion is experienced as a fire-ball
to emit liquid and then exploded. Further BLEVEs occurred at with a short but intense release of thermal energy.
around 9.30 a.m. BLEVEs are not only experienced with storage vessels
Eighteen people (eleven firefighters, two refinery such as spheres and cylindrical tanks (bullets), but also in
employees, three subcontractor workers, one employee from transportation tanks (road tankers and rail tank cars) as well
the neighbouring company who came to help and the driver as gas bottles. Unfortunately, even today, many accidents
of the car that entered into the cloud) were killed because of involving a BLEVE lead to fatalities and serious injuries
the accident, and another 84 were injured. The explosion and amongst fire-fighters and emergency responders.
subsequent fires caused the destruction of five of the spheres,
two horizontal cylindrical tanks and four floating roof jet fuel Causes
and gasoline tanks, as well as other damage. The accident
affected 1475 homes and other constructions off-site. The primary cause of the propane leak was the operational
failure by the plant operator; this was made easier by the
BLEVE difficult access to the valves and the lack of permanent
valve spanners. It is likely that a solid plug of ice or propane
Boiling Liquid Expanding Vapour Explosions are a particular hydrate stopped the draw-off line above the upper valve.
hazard where flammable substances are stored in pressure This plug released when the upper valve was fully opened.
vessels. A BLEVE generally occurs when such a pressure The discharge from the drain line was directed downwards
vessel is exposed to fire, and the metal loses strength and in the immediate vicinity of and under the valves, instead of
ruptures (this is often below the maximum design pressure to the side. This caused frost burns suffered by the operator
of the vessel). Particularly vulnerable are those parts of the and formed the cloud, which made the recovery and
vessel only in contact with the vapour phase as the bulk liquid re-positioning of the valve lever impossible.
absorbs some of the thermal energy.
The essential features of a BLEVE are: Lessons learned
• the vessel fails; • Where possible, the direct draining of aqueous liquid
from LPG vessels should be avoided on systems that
• flash-off of vapour from the super-heated liquid;
have to be regularly operated and, in particular, where
• combustion of the vapour.
large volumes of LPG at high pressure could accidently
A BLEVE usually generates missiles, which may be fragments be released. If it is not practical to install a closed draining
created in the course of the rupture, but also the shell of the system then consideration should be given to the use of
vessel itself. The mechanical energy released is high at the a de-watering pot, which may be positively isolated from
moment of bursting and this can lead to the vessel rocketing. the main vessel during the draining operation.

© Institution of Chemical Engineers

0260-9576/16/$17.63 + 0.00

feyzin.indd 12 30/09/2016 13:13

 Loss Prevention Bulletin 251 October 2016 | 13

• Design considerations: which are not readily determined in an emergency. The

– Fit a remotely controlled emergency isolation valve in principles to be applied are to cool the affected tank, cool
the drain line. installations in the vicinity and ensure that emergency
– Install flammable gas detectors to provide early responders (and their vehicles) are kept at a safe distance
warning of a leak. as far as possible.
– Provide deluge systems with sufficient water supply
to flood the surface of the storage vessels. These Further reading
systems must be regularly maintained and tested. 1. Anon (1987), The Feyzin Disaster, Loss Prevention Bulletin
– Slope the ground so that any spillage runs off to a 077, October 1987
collection pit and does not accumulate under 2. Mannan, S (Ed.) (2012) Lees’ Loss Prevention in the
storage vessels. Process Industries, 4th Edition, Vol 3, p 2555 - 2556 ,
– Insulate vessels with a fire resistant insulation, such as Butterworth-Heinemann
vermiculite or mound the vessels with sand or similar.
3. Mannan, S (Ed.) (2012) Chapter 17.29 Boiling Liquid
– The legs of spheres should be protected against fire
Expanding Vapour Explosions in Lees’ Loss Prevention in
and impact with missiles.
the Process Industries, 4th Edition, Vol 2, p 1538 - 1545 ,
HAZARDS HAZARDS
• Operating considerations: HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZAR
Butterworth-Heinemann
AZARDS HAZARDS HAZARDS
– Management and supervisors must ensure that HAZARDS HAZARDS HAZARDS HAZARDS
4. Mannan, S (Ed.) (2014) Lees’ Process HAZARDS HAZARD
Safety Essentials,
ZARDS HAZARDS
operators HAZARDS
apply the correct HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS
operating procedures. Butterworth-Heinemann, Chapter 21
DS HAZARDS HAZARDS
This involves regular HAZARDS
training and observation HAZARDS
of work HAZARDS
5. N° 1 -  HAZARDS
04/01/1966 -  FRANCE HAZARDS
- 69 – FEYZIN, http://www. HAZARDS HAZ
ZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS
practices. aria.developpement-durable.gouv.fr/wp-content/files_mf/
DS– HAZARDS HAZARDS HAZARDS HAZARDS
Consideration must be given to the work conditions
for hazardous operations. This should include access,
HAZARDS HAZARDS HAZARDS HAZARDS HAZ
FD_1_feyzin_GC_ang.pdf

ARDS HAZARDS HAZARDS HAZARDS

lighting, and availability of tools, as well as effectivity HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS H
6. Failure Knowledge Database – 100 Selected Cases, Fire
and Explosion of LPG Tanks at Feyzin, France http://www.
ZARDS HAZARDS
of intended HAZARDS HAZARDS HAZARDS
operating procedure. HAZARDS HAZARDS HAZARDS HAZARDS
sozogaku.com/fkd/en/hfen/HC1300001.pdf
HAZARDS HAZARDS
• Emergency response
HAZARDS HAZARDS 7. Burnt out storageHAZARDS
HAZARDS spheres, Feyzin HAZARDS HAZARDS HAZAR
DSAtHAZARDS
facilities handlingHAZARDS HAZARDS
LPG or similar products firefightersHAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZ
8. http://numelyo.bm-lyon.fr/
ARDS
must beHAZARDS HAZARDS
trained in the correct approach to HAZARDS
dealing with HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS H
BML:BML_01ICO00101P0702_B02_07_618_00001?&que
HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZAR
a storage vessel engulfed by fire. The time to BLEVE is ry%255B%255D=%2522gaz%2522&hitStart=85&hitTotal=1
AZARDS HAZARDS
difficult to assess and depends HAZARDS
on a number of HAZARDS
factors, HAZARDS HAZARDS HAZARDS HAZARDS HAZARD
55&hitPageSize=16
ARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS H

Hazards27
RDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HA
ZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS
DS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZ
AZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARD
ARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS H
ZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS
In association with the Mary Kay O’Connor Process Safety Center
HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZAR
DS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZ
ARDS 10– 12 May HAZARDS
HAZARDS 2017, Birmingham, HAZARDS UK HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS H
AZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARD
HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZAR
AZARDS Save HAZARDS the date HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARD
ZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS
DS HAZARDS HAZARDS
Join us at Europe’s HAZARDS
leading process HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZ
safety event.
ZARDS Hazards 27 is an excellent opportunity to review your HAZARDS
HAZARDS HAZARDS HAZARDS HAZARDS
process safety practices, networkHAZARDS
with HAZARDS HAZARDS
DS HAZARDS HAZARDS
other practitioners, and discoverHAZARDS HAZARDS
products and services to improveHAZARDS HAZARDS HAZARDS HAZARDS HAZ
process safety performance.
ARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS H
ZARDS Save HAZARDS
the date in your HAZARDS
diary and join us HAZARDS HAZARDS
in Birmingham, UK on 10–12 May HAZARDS
2017. HAZARDS HAZARDS HAZARDS
HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZAR
Registration opens December 2016.
DS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZ
ARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS H
HAZARDS www.icheme.org/hazards27
HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZAR
AZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARD
ARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS H
RDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HA
ZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS
© Institution of Chemical Engineers
DS HAZARDS+ 0.00
0260-9576/16/$17.63 HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZ
AZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARD
ARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS H
feyzin.indd 13 ZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS HAZARDS
30/09/2016 13:13
 14 | Loss Prevention Bulletin 251 October 2016
Incident
Seveso – 40 years on
Mark Hailwood, LUBW, Germany
Saturday 10 July 1976 was a day that changed the face of
chemical process safety in Europe and linked a small northern
Italian town with a European Directive and with a particular
chemical molecule.
Introduction
The ICMESA factory in Meda, near Milan was founded
in 1946 as a part subsidiary of the Swiss Givaudan SA of
Geneva for the production of synthetic fragrances. In 1963,
F.Hoffmann-La Roche AG bought Givaudan SA and two years
later Givaudan became the majority shareholder of ICMESA,
going on to buy up the remaining shares. By this time, in 1969,
the production of trichlorophenol had begun at the ICMESA
factory. Trichlorophenol was an intermediate in the production
of hexachlorophene, a disinfectant used in the medicinal soaps
of the Roche group.
1,2,4,5-tetrachlorobenzene was reacted with sodium
hydroxide to give 2,4,5-trichlorophenol (TCP). This was a
two stage process yielding 2,4,5 sodium trichlorophenate
and NaCl after the first stage, which was then acidulated with
HCl to obtain the final product. A side reaction, which occurs
in particular at elevated temperature is the condensation to
2,3,7,8-tetrachlorodioxine (TCDD) (see Figure 1).
Two modifications were made by ICMESA to the original
Givaudan process. Firstly the concentration of NaOH was
increased from 17.5% to 31.6%, and secondly the xylene
was distilled off before acidification. The results of these
modifications increased the contact time between NaOH and
the ethylene glycol.
The chemical process
A 10,000 litre reactor with a steam heating coil system, which
could also be used to circulate emergency cooling water, was
used for the batch process. The reactants were heated using
ethylene glycol as the solvent and the addition of xylene to
facilitate the removal of water through an azeotropic distillation.
The ingredients were heated at ca.150 °C until no further
water was formed. The temperature was then slowly increased
to ca.170 °C to remove xylene, and ethylene glycol was
subsequently removed under vacuum. Following the removal of
C l C l C l
+ N a C H
► ►
C l C l
C l
Figure 1 – Reaction of tetrachlorobenzine to produce TCP with side reaction leading to TCDD
seveso251.indd 14
ethylene glycol the reaction was quenched by the addition of a
large excess of cold water. A schematic representation is shown
in Figure 2.
The safety philosophy followed by the operator was careful
control of temperature with the goal of preventing the formation
of TCDD. The main protection device for the reactor was a
bursting disc set at 3.8 bar, which was designed to provide
protection during the initial stages of the reaction. The ethylene
glycol removal could be protected through the addition of
excess water which would cool the reaction.
The accident
On the day of the accident, the reaction was shut down with
only 15 percent of the solvent removed. This was a direct
violation of the operating procedures, which stipulated that
either no solvent should be removed or that the removal should
be completed and the reaction quenched before the reactor
was shut down. The shutdown occurred at the end of the shift
on the Saturday morning at 6.a.m., which was the end of work
as the ICMESA plant was not operating over the weekend.
With the shutdown, the reactor was no longer stirred or
heated (or actively cooled) and it was left to its own devices with
its temperature at 158°C. Some six and a half hours later the
bursting disc ruptured, releasing the contents of the reactor to
the atmosphere. The aerosol cloud that escaped contaminated
an area of about 1800 ha., encompassing four municipalities of
the Lombardy region namely the townships of Seveso, Meda,
Cesano Maderno and Desio.
At around 1 pm the deputy head of production was informed
of the incident through a telephone call by a foreman. The
deputy head of production then arrived ten minutes later, and
having inspected the area immediately surrounding the plant
noticed nothing out of the ordinary. At 7 pm he instructed
the factory porter to contact the local public health officer
for Seveso and Meda. The public health officer was however
absent and it was not possible to identify his deputy. The
incident was then reported to the carabineri at 8 pm. It was not
until after 4 pm on the Sunday that representatives of ICMESA
met the mayor of Seveso and an hour later the mayor of Meda
to warn the population not to touch or eat the local fruit and
vegetables. Only on the evening of 15 July, five days later, the
C l C l O C l
T
O H C l
C l O
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:18
 Loss Prevention Bulletin 251 October 2016 | 15

Figure 2 – Schematic diagram

Vent to roof
of Seveso reactor Condenser
(Marshall, V.C., LPB 104, Bursting disc
April 1992) Water
Stirrer Nitrogen
NaOH TCB
shaft
Vent Xylene in
Reflux

Steam in
Water (superheated)

Recovered solvent Cooling

Limpet water out
coil

Cooling water in

Condensate out
Product run off

mayors of Meda and of Seveso designated a danger zone and
prohibited the consumption of fruit and vegetables from this
zone. By Wednesday 21 July it had become clear that parts of
the neighbouring communities of Cesano Maderno and Desio
were also contaminated and that the levels of TCDD detected
of ca.300oC. Experimental evidence indicated that, without
stirring, the radiation from the vessel walls was able to elevate
the temperature of a thin surface layer to 220–230oC. This
would provide sufficient energy to initiate the exothermic
reaction. This mechanism was not understood at the time of the

were relatively high.
Experts from the companies Coalite (GB), BASF (DE), Philips-
Duphar (NL), Chemie-Linz (A) and Dow Chemicals (USA),
which had all had dioxin accidents, all recommended evacuation
of the population. The first evacuation started on Monday 26
July and involved 208 people from 37 houses (Zone A) (Figure
knowledge and
competence
accident. The production instructions did however stipulate that
the reaction should be left in a form which would not have been
as sensitive to this radiated heat.
Within the Italian prosecution documents it was claimed that

engineering
and design
3). Eventually Zone A (Concentrations > 50µg TCDD /m²) was
extended and affected 736 people who were all evacuated.
Zone B (5-50 µg/m²) included 4,700 people and Zone R (0-5 µg/ Lentate sui
m²) 31,800 people. Zone B was not evacuated. Over a period Seveso
of several years buildings were demolished or decontaminated 1km

systems and
procedures
and as far as possible the land returned to agricultural and
Meda
horticultural use. The most heavily contaminated area, Zone A,
was decontaminated in April 1984 and a park laid out by the
Region of Lombardy. Barlassina Seregno
Seveso
Causes of the accident Cesano
One of the significant causes of the accident, the initiation Maderno
of the exothermic reaction, was for some time a puzzle. Desio
Initiation of the exotherm occurs at 220oC; however, the last Bovisio
known temperature of the reactor before the operations were Icmesa
shut down was 185oC, which is sufficiently below the onset Zona A
Zona B Varedo
temperature. In 1981 Theofanous published a paper in which Zona B Nova
the radiated heat from the reactor walls and its effect on a Milanese
thin top layer of the reaction mixture was considered. From
the technical detail available the reactor was only charged
to just over a third (1.25 m height) and the heating was with
superheated and not saturated steam. That meant that the Figure 3 – Contamination zones (it.wikipedia.org,
upper two-thirds of the reactor initially had a temperature public domain)

© Institution of Chemical Engineers

0260-9576/16/$17.63 + 0.00

seveso251.indd 15 30/09/2016 13:18

 16 | Loss Prevention Bulletin 251 October 2016
the reactor had never before been left in this unusual state. The
claim was undisputed. However had appropriate consideration
been given to the knowledge and understanding of the
workforce (including the management and supervisors) and
possible deviations from normal operation, then the possibility
that the process was stopped part way was realistic.
Readers need to be aware that in 1976 concepts of “safety
culture” and “human factors” were not well developed in the
chemical process industries — in fact, in numerous industrial
operations today, these issues present a considerable challenge.
Lessons learned from the Seveso accident
1) It is important that operators of facilities handling hazardous
chemicals understand the thermodynamics of the reactions
carried out. This includes side reactions and decompositions
which may take place under plausible deviations from the
intended reaction procedure.
2) Operating personnel must adhere to standard operating
procedures. Production planning should be designed so
that operations can be concluded safely within the available
time-frame. Supervisors and management personnel should
make themselves aware of the real operating practices and
take appropriate action to ensure that training is carried
out and expectations are communicated effectively. The
safety management system should be devised to provide
an appropriate structure to ensure that safe operation is a
reality.
3) Batch reactors should as far as possible be provided with
pressure relief systems that exhaust to containment systems
to prevent either a release to the working environment or
to the external environment. Modern blow-down systems
exist which use tanks, bags or other forms of suppression.
4) In the event of a loss of containment event the alarm
and emergency plan should be activated immediately
and the internal and external communication channels
provided with all of the relevant data and information to
enable the correct response decisions to be taken. The
operating company should draw up such plans well in
advance and communicate them to the local authorities
and coordinate them with external emergency responders.
Regular exercises should be conducted. These should also
cover the transmission of information through the various
communication channels so as to ensure that information
is provided, and that it is understood and acted upon
appropriately. Operating companies cannot assume that
they will be communicating with experts in the field of
chemistry or toxicology; therefore the messages must be
timely, clear in their interpretation as well as in the necessary
measures to be adopted.
5) External emergency responders need to develop
emergency response plans in advance and to train their
implementation, including the communication channels.
Should an emergency occur, then coordination and liaison
with the law enforcement agency should take place to
ensure that access to vital information and expertise is not
inhibited through legal proceedings. As far as possible
information on the appropriate measures to be taken in an
emergency should be made available to the public in the
area which could possibly be affected by a major accident.
This information should be designed so that it can be readily
seveso251.indd 16
understood and is likely to be read and implemented in an
emergency.
Many of these lessons have become parts of the requirements
of the so called Seveso Directives which are implemented
within the Member States of the European Union and the
European Economic Area. Other countries such as Australia and
New Zealand have also adopted similar regulations. However
regulations alone do not guarantee that accidents will not occur.
It is necessary that the industrial operators are conscious of their
responsibilities and that the public authorities carry out effective
enforcement. For jurisdictions without effective chemical
accident prevention, preparedness and response programmes
there is a need to consider the risks posed in carrying out
chemical operations without a robust framework. Guidance
for establishing such programmes has been developed by the
United Nations Environment Programme as well as the OECD
and the EU.
Further events with loss of control of
exothermic chemical reactions
Unfortunately, history has shown that the loss of control of
exothermic chemical reactions still leads to major accidents.
Within this selection it is clear that the lessons listed above
have not been learned throughout the chemical processing
community. Particularly vulnerable are toll manufacturers, which
manufacture but do not always have the background in the
chemistry, reaction kinetics or chemical engineering. Indeed
some of this information might not be supplied by the customer
under claims of commercial secrecy. Toll manufacturers
often produce a range of chemicals for a number of different
customers utilising a variety of reactions and processes, but
with a limited set of equipment. Typically these are batch or
semi-batch reactions together with mixing, blending, solvation,
distillation, filtering and drying. Small-scale operations usually
do not have access to process safety specialists in the same way
as larger operations. Thus the available resources for carrying
out risk assessments or executing management of changes
processes, if at all available, may be so thinly spread that they
are ineffective.
The following section documents briefly a few examples of
exothermic runaway reactions.
22 February 1993 Hoechst,
Frankfurt-Griesheim, Germany
A release occurred of almost 10 tonnes of ortho-nitroanisol from
the pressure relief valve of a reactor, leading to a sticky, yellow
precipitation (of ca. 1 t) over an area of 1.2 km length and 300m
width. A residential area for 1000 people and allotments were
affected. About 40 individuals received medical treatment for
breathing difficulties and, skin and eye irritation. Initially the
company’s communication referred to a safety data sheet with
a classification as “harmful” – in German “mindergiftig”, which
translates as “not really toxic”. The company did however
have data available which suggested that o-nitroanisol should
be classified as a possible carcinogen. The public health
authorities stated on the day of the incident that due to the low
concentration, no acute health risks arose from the chemicals
released. This did little to calm public fears, particularly as the
workers carrying out the extensive decontamination work were
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:18

wearing protective suits and face masks. An epidemiological
study over 30 years is still on-going, however the public health
authorities have come to the opinion that no instances of
chronic, asthmatic or neuro-dermatitis cases can be attributed
to the incident.
The cause of the exothermic release was that the reactor
was charged with two reactants. However in violation of the
instructions, stirring did not take place during the addition
and therefore the expected exothermic reaction (for which
cooling was foreseen) did not start. Because the reaction was
not initiated the operator had heated the reactant being added.
Some two hours after charging the reactor and not having
achieved the reaction, the stirrer was started and a spontaneous
exothermic reaction occurred.
19 December 2007, T2 Laboratories Inc.,
Florida, USA
On 19 December 2007, four people were killed and 13 others
were transported to the hospital when an explosion occurred
at T2 Laboratories Inc. during the production of a gasoline
additive called methylcyclopentadienyl manganese tricarbonyl.
The CSB determined insufficient cooling to be the only
credible cause for this incident, which is consistent with witness
statements that the process operator reported a cooling
problem shortly before the explosion. The T2 cooling water
system lacked design redundancy, making it susceptible to
single-point failures. Interviews with employees indicated
that T2 ran cooling system components to failure and did not
perform preventive maintenance.
22 April 2012, Mitsui Chemical, Iwakuni-Ohtake
Works, Japan
An explosion and fire at the resorcinol production facility led to
one death and 21 injured, two of which seriously.
Due to problems with the steam supply system during the
night before the accident, all plants using steam were ordered
to be shut down. This “emergency shut down” triggered the
interlock system switching the air supply to nitrogen and
cooling water to emergency cooling water; agitation continued.
About 70 minutes later it was determined that the temperature
in the resorcinol oxidation reactor had not dropped, therefore
the interlock was released and cooling returned to circulating
water. With the release of the interlock the nitrogen supply
was stopped and agitation ceased. The upper liquid phase of
the reactor did not have a cooling coil and decomposition heat
from the organic peroxide could not be removed, resulting
in a gradual rise in temperature. In the lower liquid phase
the temperature continued to fall. One and a half hours after
the interlock had been deactivated the decomposition of the
organic peroxide accelerated, the temperature rose and gas was
generated. The pressure relief valve was activated, however
pressure continued to rise. Five minutes later the reactor burst
leading to the fire and explosion.
01 December 2014, Pirna, Germany
A serious explosion in a chemical factory caused the death of
one person and seriously injured four others. Debris was strewn
over the surrounding area. The reactor which exploded was
producing the first, larger scale batch of a flame retardant for
textiles. The investigations are still ongoing. However, there
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
seveso251.indd 17
Loss Prevention Bulletin 251 October 2016 | 17
are indications that modifications to the originally intended
production process may have been made.
References
1. Cardillo, P., Girelli, A., Ferraiolo, G. (1984) The Seveso
case and the safety problem in the production of
2,4,5-trichlorophenol, Journal of Hazardous Substances, 9,
221-234
2. CSB (2009) Investigation Report T2 Laboratories, Inc.
Runaway Reaction, Report No. 2008-3-I-FL, http://www.
csb.gov/assets/1/19/T2_Final_Copy_9_17_09.pdf
3. EU: The Minerva Portal of the Major Accident Hazards
Bureau, A Collection of Technical Information and Tools
Supporting EU Policy on Control of Major Chemical Hazards
https://minerva.jrc.ec.europa.eu/en/minerva
4. Fortunati, G.U. (1985) The Seveso accident, Chemosphere,
14, 729-737
5. Hanoversche Allgemeine, Ein Toter bei Explosion
in Chemiefabrik, 02/12/2014, http://www.haz.de/
Nachrichten/Panorama/Uebersicht/Pirna-Ein-Toter-bei-
Explosion-in-Chemiefabrik
6. Hay, A (1992) The Chemical Sythe: Lessons of 2,4,5-T and
Dioxin (Disaster Research in Practice), Plenum Press, New
York, ISBN: 0-306-40973-9
7. Hay, A. (1979) Seveso: the crucial question of reactor
safety, Nature, Vol. 281, p.521, 11 October 1979
8. Hidaka, A., Izato, Y. and Miyake, A. (2014) Lessons Learned
from Recent Accidents in the Chemical Industry in Japan.
Open Journal of Safety Science and Technology, 4, 145-156.
doi: 10.4236/ojsst.2014.43016.
9. Homberger, E., Reggiani, G., Sambeth, J., Wipf, H.K. (1979)
The Seveso accident: its nature, extent and consequences,
Ann. Occup. Hyg. 22, 327-370
10. Marshall. V.C. (1992) The Seveso Disaster: An appraisal of
its causes and circumstances, Loss Prevention Bulletin 104,
April 1992
11. Mitsui Chemicals, Explosion and Fire at Iwakuni-Ohtake
Works, http://www.mitsuichem.com/release/2012/
pdf/120829_02e.pdf
12. OECD (2001) OECD Guiding Principles for Chemical
Accident Prevention, Preparedness and Response, http://
www.oecd.org/env/ehs/chemical-accidents/Guiding-
principles-chemical-accident.pdf
13. Pocchiari, F., Silano, V., Zapponi, G. (1986) The chemical
risk management process in Italy. A case study: the Seveso
accident, The Science of the Total Environment, 51, 227-
235
14. Sambeth, J. (1983) The Seveso accident, Chemosphere, 12,
681-686
15. Theofanous, T.G. (1981) A physicochemical mechanism for
the ignition of the Seveso accident, Nature 211, June 1981
16. UNEP (2010) Flexible Framework for Addressing Chemical
Accident Prevention and Preparedness: A Guidance
Document, http://www.unep.org/resourceefficiency/
Portals/24147/Safer%20Production%20(Web%20uploads)/
UN_Flexible_Framework_WEB_FINAL.pdf
17. Wilson, D.C. (1982) Lessons from Seveso, Chemistry in
Britain, July 1982, 499-504
30/09/2016 13:18
 18 | Loss Prevention Bulletin 251 October 2016
Incident
Chernobyl – 30 years on
Fiona Macleod
On Saturday 26 April 1986 the citizens of Pripyat were outside
enjoying the hot weather — in the school playground, planting
out the garden, fishing in the river, sunbathing in the park,
completely oblivious to the plume of radioisotopes drifting
towards them from the nearby Chernobyl nuclear power plant.
After Saturday lessons finished, a few enterprising children
cycled up to the overpass to get a better look at all the
excitement a mile away. Across the lake — an artificially
created cooling pond for the power plant — they watched fire
engines, planes, helicopters, and truckloads of soldiers. In the
evening people came out onto their balconies to marvel.
“I can still see the bright crimson glow…We didn’t know
that death could be so beautiful”.1
At 01.23, earlier the same day, No 4 reactor had exploded
during a safety test that went horribly wrong. A series of
explosions led to the rupture of the containment and fifty
tonnes3 of nuclear fuel were ejected from the core of the
reactor, hurling uranium dioxide, iodine, caesium, strontium,
plutonium and neptunium radioisotopes into the air — orders
of magnitude greater than the radioactive release after the
bomb dropped on Hiroshima. And the fires were still burning,
yet no one had alerted the population or evacuated the town
that lay only one mile away.
Before his suicide on the second anniversary of the accident,
one of the expert investigators, Valery Legasov, wrote:
“… the (Chernobyl) accident was the inevitable apotheosis
of the economic system … in the USSR … Neglect by the
scientific management and the designers ... When one
considers the chain of events … it is impossible to find a
single culprit, a single initiator of events, because it was like
a closed circle.” 2
So was this accident unique to the nuclear industry of former
Soviet Union at the height of the Cold War? Or are there wider
lessons to be learned?
Too much haste, too little speed
Picture the scene: a meeting between a project team and the
sponsors. The Chairman opens the meeting.
“Give us an update on progress.”
The project manager rolls out a plan and begins his
presentation on the critical path for completion. After two
minutes, he is interrupted.
1
Nadezhda Vygovskaya quoted in Voices from Chernobyl
2
Testament - Valery Legasov, leader of the Soviet delegation to the IAEA
Post-Accident Review Meeting
chernobyl.indd 18
“When will you start up?”
“No earlier than August.”
“That is unacceptable. The deadline for start-up is May.”
The project manager bites his tongue. He is not going to remind
the steering group that the original project plan showed start-up
in December, that a May deadline was imposed by someone in
a remote office without any conception of what needed to be
done. Instead, he shrugs his shoulders and spreads his hands.
“Some equipment will only be delivered in May.”
The Chairman slams a fist on the table.
“Then make sure it is delivered earlier!”
He turns to the boss of the project manager.
“Your project team has failed again.”
The project manager is side-lined and new blood is brought into
the team.
The plant starts up in December.
That was the gist of an exchange in the Kremlin in 1986,
discussing another nuclear plant project, reported by
Grigori Medvedev3 because it was so unusual for a chief of
construction to challenge unrealistic deadlines in front of
ministers. After his dressing down, the project manager was
reported to mutter:
“We lie and teach others to lie. No good will come of this.”
Such an exchange could never happen today in the board room
of a multinational chemical company. Senior leaders may not
know the fine detail of every complex project, but they always
hire, trust and empower people who do.
Or do they?
Start up first, test later
Chernobyl Reactor 4 started up before the end of 1983 in order
to meet a deadline for energy production targets. Because
some of the commissioning tests were bypassed, a worrying
problem emerged. How to run the main water circulation
pumps in the event of a loss of power.
Active cooling is required in nuclear reactors, running or
idle, to remove the heat generated by radioactive decay. In the
event of a reactor shutdown, back up diesel generators were
designed to start up automatically in order to provide power
to the instruments and main water circulation pumps, however
they took over 60 seconds to reach full speed. Too long for the
core to be without cooling.
3
G. Medvedev Chernobyl Notebook
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:09

Steam
Steam
separator
Pump
Pump
Generator Turbine
Water Water to core
from
turbine
It was suggested that the steam turbines, which would
continue to spin after a reactor shutdown, might generate
enough electrical power as they were coasting down to run
the main water circulation pumps while the back-up diesel
generators were winding up, elegantly bridging the power gap.
Previous tests had proved unsuccessful, but a fourth test
was scheduled for 25 April 1986, in advance of a planned
shutdown on Reactor 4.
Opinions are divided on the risk of running such an
experiment on a nuclear power plant. However the additional
measures that the plant management took in order to make the
experiment “pure”3 added the most extraordinary risks.
The emergency cooling system was disabled: the pump
fuses removed and the valves chained and padlocked shut.
This seems to have been due to a belief that there was a
danger of heat shock if cold water was allowed to rush into
the hot core of the reactor, despite the fact that this was a
fundamental part of the design.
The test was to be carried out live. Instead of shutting down
the reactor and measuring the electrical energy generated by
the coasting steam turbine, the plan was to keep the reactor
operational so the test could be repeated if necessary.
Most of the reactor emergency shutdown systems were
disabled. In part this was to allow the test to be repeated if it
failed the first time.
These extraordinary violations, the removal of the very
back-up systems on which the safety of the plant depended,
were planned and documented and sent to the government
regulator in January 1986, well in advance of the test3. The
plant management took the lack of reply as tacit approval to
proceed. It became clear after the accident that nobody who
understood the operation of a nuclear reactor had reviewed or
understood the planned tests.
According to the expert investigator, Valery Legasov2, the
test was
“like airplane pilots experimenting with the engines in flight”
But even with these fundamental systems overridden, the test
might just have proceeded without incident, had it not been
delayed from day shift to night shift.
Before looking at what else went wrong, it is worth taking
a moment to understand the fundamental design flaws of the
RBMK nuclear reactor.
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
chernobyl.indd 19
Loss Prevention Bulletin 251 October 2016 | 19
Steam to
Steam and turbine
water from core
Water from
turbine
Core
The difficult we do right away, the impossible
takes a little longer
The experts recommended a pressurised water reactor
design (VVER) for the Chernobyl complex. The VVER
design was said to be superior — intrinsically safer with
lower emissions than the boiling water graphite moderated
reactor (RBMK). See Table 1 for a comparison of the two
technologies.
The technology chosen by the expert design team was
rejected. Why? Was it just a question of cost? Rouble per
kilowatt? Bang for Buck? It appears not.
By 1965 it was clear that mass production of the VVER
reactor would be difficult. Only one factory, the Izhora
works in Leningrad, had the necessary technical expertise
to manufacture such large and complex pressure vessels.
On the other hand the inferior RBMK could largely be
constructed on site with local suppliers of concrete and
piping. Even the graphite blocks could be transported and
engineering
and design
assembled from modules.
“Soviet scientists, engineers and planners did not take
decisions of such magnitude lightly (but)…instead of
choosing technically outstanding designs…they chose
designs they thought would meet ambitious plan targets
systems and
procedures
for nuclear power generation”4
In the end, one overriding factor trumped all the others. How
fast could the nuclear energy program be implemented?
The decision was made. The council of ministers approved
the RBMK, declaring it the safest and most economical. An
aspiration rather than a fact.
“No matter, we will adopt it…The operators have to work it
out so that … (the RBMK design) is cleaner and safer than the
Novovoronezh (VVER) design.” (Reference 3).
Such an impossible task — take an inferior design which
can be built faster and magically remove the flaws — would
never be given to the design engineers in a modern chemical
company.
Or would it?
culture
4
Producing Power: The Pre-Chernobyl History of the Soviet Nuclear
Industry by Sonja D. Schmid
30/09/2016 13:09
 20 | Loss Prevention Bulletin 251 October 2016

Technology5 VVER RBMK

Pressurised water reactor Graphite moderated water cooled reactor
Novovoronezh Reaktor Bolshoy Moshchnosti Kanalniy
Водо-водяной энергетический реактор Реактор Большой Мощности Канальный
Emissions 100 curies/day 4,000 curies/day
Turbine driven by Steam from Secondary circuit – primary water is pressurised to Steam from Primary circuit – water boils in core and drives turbine
remain liquid in core and exchanges heat with water in secondary
circuit which boils to drive turbine
Moderator Water Solid Graphite
Coolant Water Water
Loss of coolant Intrinsically Safer - The neutron moderation effect of the water Unstable - The neutron moderation by graphite continues, no loss of
diminishes, reducing reaction intensity reaction intensity leading to overheating
Void coefficient of Negative (good) Positive (bad)
reactivity5
Fuel Enriched Uranium dioxide Enriched Uranium dioxide
Refuelling Full shutdown required On-line. Multiple independent fuel channels.
Containment Steel pressure vessel Leak-tight (explosion prone) concrete box with bubbler pool
underneath
Other Design favoured outside USSR Originally designed to provide Plutonium for military use
Construction Construction in specialised fabrication shop. High quality factory Modular. Assembly on site. Graphite, cement and piping
based steel forging
Capital Cost Rouble/ 190-2106 250-2706 (actual)
kW Power output 1907 (aspirational)

Table 1: Comparison of VVER and RBMK designs

RBMK design flaws Neutron Moderating

scattering Ratio8
Design flaw 1 – positive void coefficient of Cross-section Neutron (Slowing down
( s) in barns absorption power vs
reactivity Moderates cross-section Macroscopic
In a nuclear chain reaction, a neutron collides with a nucleus, speed of ( c) in barns absorbtion cross
splitting it to release heat and more neutrons (nuclear fission). neutron, Stops fission section)
Promotes
The neutrons must be slowed down (moderated) to increase fission
the probability of the next fission and sustain the chain Water (H2O) ~100 0.66 70
reaction. Extra neutrons must be removed (absorbed) to
Graphite (C) 4.8 0.004 170
prevent a runaway reaction and core meltdown. The power of
the reactor is controlled by inserting and withdrawing control Boron 10 ~0 3800 ~0
rods containing a neutron absorber, in this case boron.
In the RBMK design, the moderator and coolant are of Table 2: Properties of water, graphite and Boron 10
different materials. Water is a more efficient coolant and a
more effective neutron absorber than steam (see Table 2) Design flaw 2 – Control rods
Excess steam reduces the cooling of the reactor, but the
graphite moderator allows the nuclear chain reaction to The designers of the RBMK understood the first design
continue. As steam bubbles (voids) form, the reactor power flaw. A supervisory control system continuously calculated
increases, releasing more heat and more steam and so power and displayed the operating reactivity margin (ORM). The
continues to increase in a vicious spiral. This is known as a secondary safety systems were beefed up — a minimum
positive void coefficient of reactivity. number of control rods were to remain in the core at all times,
In the VVER design where the water circuit is both the AZ-5 emergency button which inserted further control rods
moderator and coolant, excess steam generation reduces the in 20 seconds and independent emergency cooling.
slowing of neutrons necessary to sustain the nuclear chain But there was another problem with the RMBK design that
reaction. More steam means lower reactor power, less heat was less well known, a design flaw that was first noticed in
and less steam, returning the reactor to stability. This is known December 1983 during the commissioning of Ignalina Unit
as a negative void coefficient of reactivity. 1 (Lithuania was then part of the USSR). As the control rods
descended into the core, the operators observed a surge in
the power. The tip of the control rod was made of graphite.
5
http://users.owt.com/smsrpm/Chernobyl/RBMKvsLWR.html As the control rod descended it displaced water, so instead of
6
The Economics of Nuclear Power in the Soviet Union. William J. Kelly,
Hugh L. Shaffer and J. Kenneth Thompson, Soviet Studies. Vol. 34, No. 1
(Jan., 1982), pp. 43-68 8
Nuclear Power Generation: Incorporating Modern Power System Practice
7
Semenov edited by P.B. Myerscough

© Institution of Chemical Engineers

0260-9576/16/$17.63 + 0.00

chernobyl.indd 20 30/09/2016 13:09


Prohibited position:
rod pulled out too high
By pushing the rod down,
the reactivity increases
Neutron absorber
rod, Boron-Iron alloy Rod in normal
operational position
Graphite displacer Rod in normal
shutdown position
Graphite moderator
Fuel elements
Water from main
cooling pumps
Water coolant, neutron absorber
I II III IV
Diagram from http://consumedland.com/page_06_en.html
reducing the power of the reactor, the power increased.
In 1983 in Ignalina Unit 1, the reactor was stable; the cooling
water was flowing and the automatic control was regulating.
The temperature and pressure did not soar, the channels
did not warp, the control rods did not get stuck and over 20
seconds the graphite tip continued to descend beyond the
core allowing the boron section of the control rods to slip into
place and stop the nuclear reaction.
But in 1986 in Chernobyl the reactor was unstable; the
incoming night shift had allowed the power to drop to a
dangerously low level and the primary water circuit was
surging uncontrollably. The reactor operator attempted to
stabilise the reactor manually. When his supervisor realised
that control had been lost, he hit the emergency AZ-5 button.
The control rods started to fall. The entry of the graphite tip of
the control rod into an already unstable reactor was the final
straw.
The first explosion happened seconds later.
Не пили сук, на котором сидишь –
Don’t saw through the bough you’re sitting on
Plant Manager Bryukhanov (a turbine specialist) and Chief
Engineer Formin (an electrical engineer) had approved the
unsafe-safety test. It appears that their interest in assessing
the electrical power from a coasting turbine had blinded them
to the dangers of operating of a nuclear reactor with safety
systems disabled. Formin had only recently returned to work
after major spinal surgery as a result of a serious car accident
and was reported to be distracted and in constant pain
(Reference 3).
The unsafe-safety test was ready to start at 14:00 on 25
Friday April 1986. Over the previous twelve hours, the reactor
power had been slowly reduced. At the last minute, the
controller of the electricity grid refused to allow the plant to
reduce power further due to a generation problem elsewhere.
All the senior managers went home and the reactor remained
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
chernobyl.indd 21
Loss Prevention Bulletin 251 October 2016 | 21
at 50% power for another nine hours. At 23:10 the electrical
grid controller called to say that the supply/demand balance
was back to normal.
At midnight, the new shift took over.
Although there are many alternative versions, the description
of events that follows is largely as described by Grigori
Medvedev’s book (Reference 3) and dramatised in an excellent
BBC documentary9.
Deputy chief engineer Anatoly Dyatalov, a physicist by
training, came with them. According to colleagues, he was
a difficult man to get along with and had little respect for his
subordinates.
Yuri Tregub from the previous shift remained on site,
handing over to shift supervisor Aleksandr Akimov and reactor
operator, Leonid Tuptunov (26 years old and 3 years out of
college). All had the necessary training in nuclear reactors, but
were repeatedly overruled and threatened by their superior,
Dyatalov.
The reactor was not designed to run at low power, and
the operator overshot the test target, the reactor power
plummeting to 30MW thermal at 00.28. Akimov and Toptunov
wanted to abort the test but were overridden by Dyatalov who
forced them to continue, threatening to have Tregub take over.
Toptunov began to withdraw the control rods as instructed,
and was able to raise the power to 200 MW thermal at around
1:00 am.
With only a few control rods in the core, the reactor’s
capacity for excursion now exceeded the ability of the
remaining safety systems to shut it down (Reference 3).
At 01:19 alarms showed that the water level was too low.
Toptunov tried to increase the water flow manually, by now
all eight recirculation pumps were running, but with small
temperature changes causing large power fluctuations the
reactor was increasingly unstable.
By 01:21, the caps on the fuel channels were reported to
be jumping in their sockets. The control room printout of core
reactivity showed the excess reactivity required immediate
shutdown — the warning was ignored and the test initiated.
At 01:23:04 the experiment began by closing the steam
to the turbine. As the momentum of the turbine generator
decreased, so did the power it produced for the pumps. The
water flow rate decreased, leading to increased formation of
steam voids (bubbles) in the core.
The reactor power increased. Toptunov reported a power
excursion to Akimov.
At 01:23:40 Akimov decided to ignore Dyatalov and abort
the test. He pressed the AZ-5 emergency button to insert the
control rods and shut down the reactor.
As the graphite tips descended, the rate of fission increased,
the reactor power surged. The control rods stopped one
third of the way down. In desperation, Akimov disconnected
the motor clutches in the hope that the rods would descend
into the core under their own weight, but the rods did not
move. The intense heat had ruptured the fuel channels. The
rising pressure from the excess steam broke every one of the
pressure tubes.
The first explosion at 01:23:44 ruptured the reactor vessel,
9
BBC Drama Documentary “Surviving Disaster” (https://www.youtube.
com/watch?v=njTQaUCk4KY)
30/09/2016 13:09
 22 | Loss Prevention Bulletin 251 October 2016
lifted the 1000 tonne upper reactor shielding slab and rotated
it by about 90o. This was followed by a second, more powerful
explosion. Lumps of fuel and graphite were ejected from the
core catching fire as they hit the air.
Thirty one people died as a direct result of the accident:
reactor operators, fire fighters and emergency responders.
One man died immediately, killed by the explosion and forever
buried in the rubble, one of a heart attack, the others suffered
unimaginable pain as they succumbed to acute radiation
exposure over the following days and weeks.
The total number of causal deaths (premature deaths due to
radiation exposure) and injury is hotly contested and will not
be covered here.10
The blame game
A first report11 into the accident blamed the night shift
operators.
“…the primary cause of the accident was the extremely
improbable combination of rule infringement …
(intentional disabling of the emergency protection
equipment) … plus the operational routine allowed by the
power station staff.”
Many disagreed.
“In the process of operating nuclear power plants…
(operators)…have to make a large number of independent
and responsible decisions… Unfortunately you will never
have instructions and regulations that envisage the entire
diversity of every possible combination of states and
maladjustments.” (G. Medvedev Reference 3)
“The operator activated…the reactor emergency shutdown
system…but…(it)…thrust the reactor into a prompt critical
state.” (Minenergo expert Gennaddi Shasharin as reported
in Reference 4)
And even if his actions had contributed to the accident.
“Human error can never be fully eliminated, even among
highly qualified specialists. If one operator’s mistake could
lead to a reactor explosion… then nuclear power should be
abandoned.” (Reference 4)
A later report into the accident12 took account of the design
flaws and misguided planning of the test and absolved the
hapless operators Toptunov and Akimov who, through acts of
extraordinary selflessness and bravery, helped to prevent the
disaster spreading and paid with their lives.
So what of the designers? They knew about the flaws. Were
they responsible?
“Complex technological systems usually have innumerable
problems … We all operate and use imperfect systems
on a daily basis. We know about flaws and how to work
around them… but it does require knowledgeable, skilled
operators who understand how to compensate for the
flaw, know their limitations and are committed to safety
10
http://www.unscear.org/docs/reports/2008/11-80076_Report_2008_
Annex_D.pdf
11
IAEA Report INSAG-A 1986
12
IAEA Report INSAG-7 1993
chernobyl.indd 22
above everything else, including plant targets, bonuses and
yes, orders.” (Reference 4)
Mushroom management: Keep ‘em in the
dark…
Accidents in Soviet nuclear power plants were kept secret from
the public in the USSR. Worse, they were kept secret from the
designers, engineers and operators of nuclear power plants.
Even the widely publicised details of the Three Mile Island
Accident in the USA on 28 March 1979 (core melt after loss
of cooling water to the reactor) were not made available
to scientists and engineers inside the former Soviet Union
(Reference 3).
If the management and operators of the plant had known
about the power surge in Igualina and the partial core
meltdowns in other RBMK units, would they have allowed the
unsafe-safety test to proceed?
We will never know.
The people of Pripyat were not evacuated on the morning of
Saturday 26 April because senior managers could not believe
what had happened. Eye witness accounts of an exposed,
burning core were ridiculed. Dosimeters that read off-scale for
radioactivity were declared faulty. The nuclear power complex
had been producing energy for ten years without a major
offsite incident. It was all perfectly safe.
The evacuation of Pripyat took place on Sunday 27 April.
On Monday 28 April 1986, after radiation levels set off alarms
at the Forsmark Nuclear Power Plant in Sweden, hundreds
of miles from the Chernobyl Plant, the Soviet Union finally
admitted publicly that a serious accident had occurred13.
But could such secrecy happen now?
Over my working life, I have seen a shift away from sharing
process safety stories, not only outside but also inside
companies. The short term fear of litigation outweighs the
moral duty of disclosure. Company lawyers are increasingly
forbidding technical staff to share detailed information, even
internally. While most major accidents involving fatalities are
independently investigated (what went wrong) sharing near
misses (what nearly went wrong) is every bit as important.
As chemical plants become safer, do we forget just how
dangerous they can be? Are we sometimes guilty of a willing
suspension of disbelief when things are going well? Do we
listen to those willing to speak truth to power?
“A leader who … doesn’t welcome bad news will get told
everything is ok even when it isn’t… We need leaders who
can live with a chronic sense of unease and who can spot the
warning signs of complacency creeping in.” Judith Hackett14
If the Chernobyl accident reminds us of nothing else, it is the
danger of complacency.
Conclusion
The 1986 Chernobyl accident has lessons that extend beyond
the nuclear industry and the former Soviet Union. These
lessons are directly applicable to today’s international chemical
industry.
13
Wikipedia Accessed 29th Jan 2016 (wikipedia.org/wiki/Chernobyl_
disaster#Announcement_and_evacuation)
14
http://www.hse.gov.uk/aboutus/speeches/transcripts/hackitt221013.htm
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:09

• artificially imposed deadlines lead to shortcuts;
• simplified targets in complex environments will lead to
perverse incentives and unintended consequences;
• real experts tell leaders things they don’t want to hear;
• good leaders listen;
• you don’t get safety by rules and regulation, it starts with
the design and evolves with experience;
• good design is iterative — it takes time, expertise and
feedback;
• things happen differently on night shift;
• whatever the designers intended, sooner or later the
operator will do something unimaginable — often on night
shift;
• sharing process safety information means sharing what went
right (near misses) as well as what went wrong (accidents);
• sharing process safety stories widely and acting on the
lessons they teach us is the way we shore up our defences
faster than the changes can overwhelm us;
• management of change, and a sense of chronic unease,
stops only when the field is green again.
References
1. Voices from Chernobyl – The oral history of a nuclear
disaster – Svetlana Alexievivich
2. Testament - Valery Legasov, leader of the Soviet delegation
to the IAEA Post-Accident Review Meeting
3. G. Medvedev, Chernobyl Notebook.
4. Producing Power: The Pre-Chernobyl History of the Soviet
Nuclear Industry By Sonja D. Schmid
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
chernobyl.indd 23
Loss Prevention Bulletin 251 October 2016 | 23
5. http://users.owt.com/smsrpm/Chernobyl/RBMKvsLWR.
html
6. William J. Kelly , Hugh L. Shaffer & J. Kenneth
Thompson (1982) The economics of nuclear power
in the Soviet Union, Soviet Studies, 34:1, 43-68, DOI:
10.1080/09668138208411395 To link to this article: http://
dx.doi.org/10.1080/09668138208411395
7. Nuclear Power in the Soviet Union. BA Semenov https://
www.iaea.org/sites/default/files/25204744759.pdf
8. Nuclear Power Generation: Incorporating Modern Power
System Practice edited by P.B. Myerscough
9. BBC Drama Documentary “Surviving Disaster” (https://
www.youtube.com/watch?v=njTQaUCk4KY
10. http://www.unscear.org/docs/reports/2008/11-80076_
Report_2008_Annex_D.pdf
11. IAEA Report INSAG-1 (International Nuclear Safety
Advisory Group). Summary Report on the Post-Accident
Review on the Chernobyl Accident. Safety Series No.
75-INSAG-1.IAEA, Vienna, 1986 
12.  “INSAG-7 The Chernobyl Accident: Updating of INSAG-
1” (PDF). Retrieved2013-09-12.
13. Wikipedia Accessed 29th Jan 2016 (wikipedia.org/wiki/
Chernobyl_disaster#Announcement_and_evacuation)
14. http://www.hse.gov.uk/aboutus/speeches/transcripts/
hackitt221013.htm
15. Reactor Accidents 2nd edition David Mosey. ISBN
1-903077-45-1
16. Visiting Chernobyl – Bill Murray
17. http://chemwiki.ucdavis.edu/Physical_Chemistry/
Nuclear_Chemistry/Applications_of_Nuclear_Chemistry/
Chernobyl
30/09/2016 13:09
 24 | Loss Prevention Bulletin 251 October 2016
Incident
The Sandoz warehouse fire – 30 years on
Ivan Vince, ASK Consultants, UK
Incident summary
On 28 October 1986, an official fire inspection was
carried out on a chemical warehouse on the Sandoz site in
Schweizerhalle, Basel, Switzerland. The warehouse contained
bulk quantities of a number of powerfully toxic and ecotoxic
substances, including over 800 tonnes of organophosphorus
insecticides and, of even more concern, 11 tonnes of water
soluble mercurial fungicides. The inspection deemed
everything to be in order.
A fire broke out shortly after midnight on 1 November.
The official investigation by the Zurich City Police Science
Department1 concluded that the fire was probably caused
by operator error using a blowtorch for shrink wrapping
paper sacks of the oxidising agent Prussian blue (Iron(III)
hexacyanoferrate(II)). Paper impregnated with Prussian blue is
capable of smouldering undetected for several hours, without
visible flame or smoke, before a sudden outbreak and rapid
spread of open fire.
The speed with which the fire advanced through the
warehouse overwhelmed attempts to extinguish it with foam.
Following a fatal fire (initiated by a shrink wrapping
blowtorch) a programme of large-scale trials by the UK
Health and Safety Laboratory has shown that a wide range of
flammable dusts stored in pallet stacks or on racks is likely to
present severe fire risks with rapid escalation2.
Firefighting appliances, including tugs on the adjacent
Rhine, eventually used over 10,000 m3 of water at up to an
estimated 24,000 litres per minute. The site drainage could
not cope with these quantities and flow rates, and so most of
the run-off entered the Rhine.
Due apparently to confusion among the Swiss authorities,
the international alarm system for Rhine accidents was only
activated after a delay of nearly 24 hours.
Short-term consequences of the incident
The incident was one of Western Europe’s worst
environmental disasters. Contaminated firefighting water
killed nearly all aquatic life for a significant distance
downstream – dead eels were found up to 200 km from
the incident. Significant pollution was detected all the way
to the North Sea. The environmental impact was in places
aggravated by delays in transmission of the alarm. The
contamination of the Ijssel River and Holland’s northern
waterways probably could have been avoided if the Dutch
authorities had been given an additional twenty-four hours in
which to respond to the crisis3. Recovery, though more rapid
and complete than initially predicted, took several years.
In their enthusiasm, the firefighting tugs also inadvertently
sandoz.indd 24
spread the contamination around a large area of land, to
a depth of up to 14 metres, thus potentially impacting the
groundwater. Much drinking water downstream was derived
from the river, so impacted communities had to rely on tankers
for up to three weeks after the incident. A considerable
number of livestock drinking from the river died.
Firefighters and others exposed to smoke from the fire
suffered acute health effects of varying severity – mainly
respiratory, eye irritation and nausea. No long-term effects
were recorded.
Decontamination involved a workforce of over 200 and took
nearly three months. Thousands of tonnes of contaminated
material were removed from the site and surroundings,
including the river bed. Direct costs arising from the incident
totalled approximately €90 million, including €27 million
paid in compensation to government authorities, fishing
organisations and private individuals.
Lessons learned
Building standards for chemical warehouses should be
reviewed with regard to fire resistance, prevention of
flammable vapour accumulation, and ease and safety of
firefighting operations.
Hazardous substances should be segregated into
appropriately sized compartments, with due regard for fire
risks. Following the incident, Sandoz voluntarily reduced its
inventories of the most hazardous substances, eliminating
altogether the storage of mercury compounds.
The magnitude and nature of fire risks in the bulk storage of
hazardous chemicals need to be understood by workers and
communicated to the emergency services.
Provision needs to be made through the use of ditches,
dykes, embankments and sloping terrain – tertiary
containment – to prevent firefighting water leaving the
site. The design of tertiary containment should be based on
realistic worst-case water application rates and quantities.
Fire and explosion hazard management (FEHM) at
hazardous installations should be formally planned,
beginning with a scenario based analysis and a comparison of
consequence reduction measures – including controlled burn-
down.
Transmission of warnings downstream following a pollution
incident needs to be timely and effective. Following the
incident, the Rhine Warning and Alarm Plan4 was improved by
the development and validation (using chemical tracers) of a
computer model to predict in three dimensions the progress
of pollutant waves.
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:17

Legacy
The Seveso Directive was amended (Council Directive
88/610/EEC, 24 November 1988) to strengthen requirements
for the storage of hazardous substances, in particular, to bring
isolated storage into the scope of the Directive (i.e. storage not
associated with an industrial operation).
Seveso II (96/82/EC, 9 December 1996) had an increased
emphasis on environmental protection, including consideration
of transboundary effects. While resisting pressure following
the accident to accede to the Directive, Switzerland (which
is not a member of the EU) did in 1991 adopt regulations to
control risks, including risks to the environment, from major
accidents5.
According to the International Commission for the Protection
of the Rhine (ICPR), “The Sandoz accident became a turning
point for environment and water protection in the Rhine
catchment”. In 1987, environment ministers of the seven
countries bordering the Rhine adopted the three-phase Rhine
Action Programme, coordinated by the ICPR, with ambitious
targets including the halving of inputs of dangerous substances
by 1995 and the return of salmon by 2000.
The UNECE Convention on the Transboundary Effects of
Industrial Accidents 1992, which came into force in 2000,
obliges the contracting parties to prevent as far as possible
accidents with transboundary effects, to reduce their
frequency and severity, and to mitigate their residual risks. It
promotes active international cooperation between the parties
before, during and after an industrial accident.
Postscript
In 1987, the Sherwin-Williams warehouse in Dayton, Ohio,
USA, containing over 5.5 million litres of paint and paint-
related products, caught fire and the installed sprinkler systems
and fire wall were quickly overwhelmed. The warehouse
was situated over an aquifer that provided drinking water to
approximately one-third of the local population of 400,000.
The warehouse was allowed to burn down. The decision
was taken following early consultation among company
representatives, fire responders, air and water pollution
experts and public officials. The consensus was that the risk
of contaminating the underlying aquifer with firewater run-off
far outweighed that associated with the smoke plume if the
fire was allowed to continue with minimal intervention. Only
as much water was applied to manage the burn-down safely as
could be retained on site6.
Unfortunately, the lessons from Sandoz, fresh in the minds
of the Dayton responders (the incident report appended a
summary of the Sandoz disaster), seem to have been forgotten
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
sandoz.indd 25
Loss Prevention Bulletin 251 October 2016 | 25
a few years later. The fire at Allied Colloids (Bradford, UK)
in 1992 resulted in considerable environmental damage to
the local Aire and Calder rivers, largely due to firefighting
activities. The incident highlighted a number of shortcomings
both in technical/safety precautions and FEHM measures
including management of firefighting run-off7. In fairness,
these errors were largely made prior to the incident; the fire
service had no option but to fight the fire, which threatened
nearby warehousing and very large storage tanks of highly
flammable liquids.
Following the December 2005 explosion and fire at the
Buncefield UK oil terminal, which led to contamination of
groundwater despite the provision of considerable tertiary
containment, the investigation report recommended that
controlled burn down should be considered in the site
specific planning of firewater management, together with
bund design factors such as firewater removal pipework8.
References
1. Schwabach A (1989) The Sandoz spill: the failure of
international law to protect the Rhine from pollution.
Ecology Law Quarterly 16(2) 443-480. http://
scholarship.law.berkeley.edu/cgi/viewcontent.
cgi?article=1355&context=elq.
2. Essa MI, Atkinson G (2004) Fire hazards of packaged
flammable dusts — follow up of HSE’s INVESTIGATION
AND FIRE TRIALS. IChemE Symp. Ser. 150 (Hazards
XVIII), pp380-391.
3. Schwabach A op. cit.
4. http://www.iksr.org/en/topics/pollution/warning-and-
knowledge and
competence
alarm-plan/index.html.
5. 814.012 Verordnung über den Schutz vor Störfällen
(Störfallverordnung, StFV) vom 27. Februar 1991 der
Schweizerische Bundesrat. https://www.admin.ch/opc/
en/classified-compilation/19910033/index.html#app14.
6. Copeland TD, Schaenman P (1987) Sherwin-Williams
paint warehouse fire Dayton, Ohio (May 27, 1987)
with supplement on Sandoz chemical plant fire,
Basel, Switzerland. US Fire Administration Technical
Report Series, Major Fires Investigation Project Report
systems and
procedures
009. https://www.usfa.fema.gov/downloads/pdf/
publications/tr-009.pdf.
7. http://www.hse.gov.uk/comah/sragtech/
casealliedcol92.htm.
8. HSE (2007) Safety and environmental standards for fuel
storage sites – Buncefield Standards Task Group (BSTG)
Final report. http://www.hse.gov.uk/comah/buncefield/
bstgfinalreport.pdf.
30/09/2016 13:17
 26 | Loss Prevention Bulletin 251 October 2016
Incident
The Challenger Space Shuttle disaster
John Wilkinson, Human Instrumental Ltd, UK
Summary
The space shuttle Challenger disintegrated 73 seconds
after launch on 28 January 1986 killing all seven
astronauts aboard. An O-ring seal in the right solid
rocket booster (SRB) failed at lift off causing a breach in
the SRB joint seal. This let pressurised hot gas escape
and ignite, affecting nearby SRB attachment hardware
and an external fuel tank leading to structural failure.
NASA management knew the design of the SRB had a
potentially catastrophic flaw in the O-rings but did not
address this effectively. They also appeared to have
disregarded warnings from engineers and not to have
passed on their technical concerns.
Keywords: Production pressure, culture, risk
assessment, design, hindsight bias
This review is based on:
• the original (brief) LPB coverage1 in a wider review of
communication failures;
• the original US Presidential Commission’s report of the
investigation (the Rogers report)2;
• the US Congress Committee on Science and Technology’s
review3 of the Roger’s report and NASA’s own
investigation;
• the seminal account by Diane Vaughan (published in 1997
but recently republished as an enlarged 2016 edition —
the only change is a new foreword on Columbia)4; and
• the subsequent Columbia Accident Investigation Board’s
(CAIB) report of the 2003 Columbia space shuttle disaster5.
In considering the disaster on this 30th anniversary, the author
has aimed to stand back from the later Columbia accident.
Since 2003 Challenger is mostly seen and studied through the
lens of Columbia (as an example of an organisational learning
failure) but it is worth looking at what was known before this so
that the original accident is seen more clearly. Even though the
CAIB report acknowledges this risk explicitly, there is inevitably
a risk of hindsight bias and selectivity in such post-Columbia
accounts of Challenger. Therefore, the focus here is more
on Vaughan’s original and exhaustive account of Challenger
alone.
Like Andrew Hopkins (of ‘Lessons from Longford’ fame)
Vaughan is a sociologist, appropriate enough for the socio-
technical systems involved both in space travel and in the
process industries. Explaining major accidents of any kind
requires both engineering / technical expertise as well as an
understanding of how organisations (as social structures) and
challenger251.indd 26
people work. This sociological input produces better learning
from such events and improves the chances of avoiding future
disasters. This paper summarises the accident, its technical
and immediate causes and the contributing organisational
factors. Clear lessons emerge for the process industries. One
of the big enemies of learning from accidents is a defensive
‘checklist’ approach e.g. ‘we don’t have that equipment, that
process, that goal – so this doesn’t apply to us’. This approach
screens out potential learning opportunities. It is much better
to say ‘OK, this doesn’t look like a direct correlation, but what
can we learn?’ This turns learning into a potentially much more
productive process rather than a checklist approach.
The accident
Challenger launched at 11.38 a.m. EST on 28 January. It
disintegrated 73 seconds into the first two minute ascent
stage killing all seven astronauts on board. They included the
well-publicised presence of Christa McAuliffe, a teacher due
to teach elementary pupils from space. Rather like the Space
Lab today, the shuttle launches were then seen as sufficiently
routine to allow such diversity.
The technical explanation for the disaster is relatively
straightforward. There were two Solid-propellant Rocket
Boosters (SRBs) attached to the space shuttle. The Solid
Rocket Motor (SRM) was contained within the four main
central segments of the assembled SRB. The SRBs provided
80% of the thrust required at lift-off to get the whole shuttle
assembly off the ground and into space. The shuttle itself
initially consisted of the orbiter vehicle, the external fuel
tank and the SRBs. The solid fuel in the SRBs was reacted
to produce very hot high-pressure gas which expanded and
accelerated on moving through the rear nozzle to provide
thrust. The SRBs were jettisoned two minutes into the ascent
and were later recovered and reused. The use of solid fuel was
a well-recognised solution to provide the necessary extra thrust
required to get the shuttle off the ground and into space. It
was also a relatively cheap choice. The third attachment to the
shuttle for lift-off was the external liquid fuel tank consisting of
a hydrogen tank, an oxygen tank and an inter-tank which fed
the three main shuttle rocket engines with a hydrogen-oxygen
mix. The external fuel tank was jettisoned once the shuttle had
escaped the earth’s atmosphere and was not recoverable.
The SRBs were prefabricated by Morton Thiokol (the
contractor who designed, manufactured and maintained
the SRBs) from seven original sections into four cylindrical
segments each with factory-sealed joints. Propellant was
poured into each segment where it solidified. The four
segments were assembled after transport to the Kennedy
Space Centre and so the remaining joints were known as ‘field’
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:04

joints. The pressure generated at lift-off ignition created a
very small gap in the SRB joints. The O-rings were designed to
seal these gaps against the high pressure hot propellant gases
developing inside. The seal was achieved by using quarter-inch
diameter Viton rubber-like O-rings. There were two of these,
the primary and secondary O-rings, the secondary acting as a
back-up in case any of the hot propellant gases generated on
ignition should erode and pass the primary.
The air temperature at the launch was the lowest recorded
for any previous shuttle lift-off. This hardened the O-rings and
adversely affected their ability to achieve an effective seal. On
the previous coldest launch in January 1985, a primary joint
was breached and eroded but the secondary seal worked
as intended. For low temperature to impact on the seated
seals fully required about three days’ exposure — a relatively
rare event. On Challenger’s launch in January 1986, the hot
combustion gases produced on ignition inside the SRM on the
right-hand SRB were able to erode and then ‘blow by’ both the
primary and secondary O-rings on the aft field joint. Cameras
captured the resulting smoke puffs at the joint showing that the
grease, joint insulation and O-ring material were being burned
and eroded by the hot propellant gases.The escaping gases
ignited and the ensuing flame started to damage the adjacent
SRB aft field joint attachment hardware and then was deflected
onto the external fuel tank. The hydrogen tank located aft
within the external fuel tank either failed or was weakened and
the liquid fuel inside subsequently leaked and started burning.
The original flames by this time had also caused the SRB lower
strut connecting it to the external fuel tank to break. The SRB
then rotated away and the external fuel tank itself failed leading
to a major release of hydrogen and a subsequent fireball (not
an explosion)4[p39]. The shuttle was also by then breaking up
mechanically in the normal atmospheric turbulence associated
with the launch because the external fuel tank was a key
structural part (the ‘backbone’) of the whole shuttle assembly.
Lessons learned
The lessons are listed here but the detail which underpins the
organisational causes is discussed further below.
Lessons for the process industries
• External pressures on organisations, such as the production
pressures on NASA, can establish ways of doing things in
the organisational culture, structure and processes which
incrementally align reality with what the organisation
wishes for — its goals. Managing these pressures and
being mindful of their potential distorting effects is difficult
and requires vigilance over time and a proper sense of
chronic unease.
• To prevent such pressures distorting an organisation’s
arrangements it is important to establish a clear baseline
or rationale for e.g. engineering and technical decisions,
so that any incremental movement away from this can be
spotted.
• Incremental changes can lead to the normalisation process
so that each individual anomaly is explained or justified but
the full picture is not seen until after a significant adverse
event. Each event is rationalised and validated against e.g.
risk assessment processes but not evaluated (“Is this really
doing what we want? Against what baseline?”)
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
challenger251.indd 27
Loss Prevention Bulletin 251 October 2016 | 27
• Risk assessment should not be about maintaining or
defending the status quo — the process should not
take over from the purpose. A questioning attitude and
mind-set is required. There is always the possibility that
something new is happening which designers could not
foresee.
• Organisations need sufficient checks and balances
for safety to ensure that safety is not over-ridden by
organisational structures and processes. These can include:
sufficiently independent and resourced safety oversight
and an adequate baseline for key arrangements such as
engineering and design decisions. If key decision makers
cannot see the baseline (or if the baseline is wrong) they
cannot easily spot significant deviations from it, especially
when these are incremental.
• Whether a new design is developed or an old one used
or modified, there are risks to be managed. New designs
bring in more potential for ‘Unknown unknowns’. In
the case of the SRBs, the existing designs (such as the
Titan rockets) were not a straight ‘read across’ to the
space shuttle, and introduced misunderstandings about
redundancy.
Lessons for investigators
• If the full underlying causes (organisational and some extra-
organisational) are not understood and learned from, and
the organisation’s structure and arrangements changed and
maintained accordingly, then accidents can and will repeat.
• Just relying on the official investigation reports for major
accidents can be misleading and incomplete. Even with
good investigations and reports, what the press and others
choose to focus on is not necessarily the full picture, and
nor is a company digest or flyer. Companies need to think
for themselves and exercise judgement about the full range
of lessons learned and consider the full picture presented.
This implies that they know what good looks like for an
engineering
and design
investigation and what the underlying organisational
factors may be.
• Learning is a process and not just an outcome.
Organisations can learn something from most incidents
if they view learning in this way. Using a screening out or
defensive checklist approach will inhibit learning.
• The hindsight bias can warp investigator judgements and
skew the lessons drawn from accidents like Challenger.
Investigators need to establish the full baseline against
which key decisions and actions occurred. The history
of O-ring anomalies and how to interpret them may look
obvious after the Challenger failure but was not obvious
to those involved at the time. Based on what they knew or
was available to them they acted rationally and in line with
human factors
the prevailing safety processes.
• Investigations which produce stereotypes (heroes or
villains in whatever guise, such as ‘management’) are good
stories but unlikely to change anything or produce real
learning. People generally behave in ways that make sense
to them at the time. The first job in an investigation is to
culture
understand things from their viewpoint.
• The full impact of human factor issues on issues such as
critical communication arrangements (like those affecting
30/09/2016 13:04
 28 | Loss Prevention Bulletin 251 October 2016
the final teleconferences) and fatigue can be missed if
investigators either do not prioritise human factors or do
not value them sufficiently. These factors can be major
contributors to poor decision-making.
The organisational causes
The underlying causes of the disaster are complex and
organisational. These are discussed below.
Launch delays
The launch was put back five times from the original 22 January
date before the disastrous launch on 28 January. The shuttle
before this was delayed seven times over 25 days before
finally launching on 12 January. This affected the subsequent
Challenger launch. The last two delays were due to weather
and a fault respectively. Delays were a major concern for NASA
because the launch schedule had become central in their
competition for scarce funding. Production pressures were at
their peak before the Challenger launch.
The O-rings and the launch decision
The problem with the O-rings was documented from
1977, long before the first shuttle flight in 1981. Evidence
accumulated from 1977 to 1985. During a final teleconference
running up to around midnight of the day before the launch,
engineers from Morton Thiokol, the SRB manufacturer, and
NASA managers debated whether the launch should go ahead
because of the predicted very low temperatures expected
and the likely effect on the O-rings. As the Commission,
the Committee, the press and others investigated “…they
created a documentary record that became the basis for
the historically accepted explanation of this historic event;
production pressures and managerial wrongdoing.“ 4[pxxxiv] The
Rogers Commission “…found that NASA middle managers
had routinely violated safety rules requiring information about
the O-ring problems be passed up the launch decision chain
to top technical decision makers…” ibid[pxxxiv] The top-down
pressures on NASA included competition, scarce resources
and production pressures. These led finally to a flawed and
deliberate launch decision.
Vaughan’s very thorough investigation provides a more
nuanced view, and ultimately a more convincing one.
Her conclusions also make more sense in the light of the
subsequent Columbia disaster. Rather than the simplistic
popular account derived from the Rogers Commission and
the Committee’s reports, she argues that “No extraordinary
actions by individuals explain what happened: no intentional
managerial wrongdoing, no rule violations, no conspiracy.
The cause of the disaster was a mistake embedded in the
banality of organisational life and facilitated by an environment
of scarcity and competition, elite bargaining, uncertain
technology, incrementalism, patterns of information,
routinisation, organisational and interorganisational structures,
and a complex culture.” ibid [pxxxvi]
The normalisation of deviance
Vaughan divides this into three elements: the production of
culture; the culture of production; and structural secrecy. The
gradual and incremental acceptance of the O-ring anomalies
was the ‘produced culture’; the scarcity of resourcing and
challenger251.indd 28
the demands of competition over a long period conspired
to establish a culture of production; structural secrecy
prevented key information from flowing effectively through the
organisation. All of these elements affected decision-making
including the final fatal launch decision.
• Accepting more risk
The normalisation of deviance helps explain:
– why the evidence of risk in the SRBs was originally
accepted in the selected design;
– why it was assessed as safe when the shuttle was
declared operational in 1984;
– why it continued to be assessed as safe; and
– why the final launch took place despite some key
engineers having and expressing misgivings.
More risk was accepted incrementally over a long period.
The risk was seen as acceptable (and accepted) and
anomalies were explained for each case after launch and
recovery. Each successful launch reinforced this. Those
involved in decisions on the SRB and the launch acted and
made decisions that made sense to them (was normal)
at each relevant time. Morton Thiokol, Marshall (The
Marshall Space Flight Center (MSFC), NASA’s rocketry
and spacecraft propulsion research centre, who had
technical oversight of Morton) and others followed the
NASA rules, arrangements and structures for the twin key
safety management system procedures — the Acceptable
Risk Process (ARP) and the Flight Readiness Review (FRR).
There were compounding errors e.g. flawed base data
on O-ring temperature limits, no effective demonstration
of the correlation of temperature data against O-ring
previous failures and in communications such as on the
understanding of O-ring redundancy between Marshall
and Morton and the way that the O-ring risk was
categorised.
• Redundancy misunderstood
The baseline for the redundancy misunderstanding
was that the SRB seal design was seen as a significant
improvement over previous designs such as the earlier
US Titan rocket which only had a primary seal. Failure of a
primary was not seen as so significant when a secondary
was in place to protect against this. The problem arises
through dependency such as the cold temperature issue.
In the process sector nowadays, the triggering of any safety
or protectives system – such as a pressure relief valve – is a
safety event in itself. In the latter case, maintenance could
be a common cause factor affecting both operational and
safety valves.
NASA processes, procedures and structures incrementally
accommodated the O-ring anomalies to align with the
overall goal — of timely and repeated successful shuttle
launches and recoveries. These weak signals were seen
but were expected and on a case-by-case basis accepted
— engineers did risk assessments and communicated the
results to managers. The latter were also mostly engineers
but with different goals and priorities set by the culture of
production. Hindsight does not show so clearly that the
context for tuning in to weak signals was against a much
wider range of anomalies detected after each launch.
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:04

• Structural secrecy
A large organisation generating huge amounts of
information, specialised engineering roles and language,
the acceptance of risk on a case-by-case basis against
established (but flawed) technical criteria and in accord
with established risk processes — all of these conspired to
prevent key technical information from flowing through the
management chain. No individual was hiding anything but
the organisation’s own structure was acting as a barrier.
• Oversight
The final barrier should have been the safety oversight
but NASA’s safety programme was famously described as
‘silent’. In fact, this was drastically reduced and especially
after the shuttle programme entered its operational phase.
Internal regulation was also subject to the effects of
interdependence, i.e. being part of the same organisation
the internal bodies were regulating. The external regulator
was even smaller and had a narrow scope. These bodies
had in truth little chance of finding the O-ring issue and not
least because it was seen and maintained as an acceptable
risk.
Design and culture
Design is an inherently uncertain process, the more so in
areas of risky technology such as innovative space missions.
However, designers in any industry make trade-offs all the time
and also are conservative — adopting the solid fuel option for
the SRBs was conservative at the time because it was a better
tried and tested approach. The fact that there were known
risks associated with this was in that sense good because they
were ‘Known knowns’ and could in principle be managed.
New designs would potentially have ‘Unknown unknowns’. For
the SRBs and the shuttle as whole such ‘Unknown unknowns’
were bound to emerge in such a risky area of technology but
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
challenger251.indd 29
Loss Prevention Bulletin 251 October 2016 | 29
Everett Historical / Shutterstock.com
NASA generally expected these and was vigilant for them.
There is also the well-rooted view that the transition from
an experimental space vehicle to an operational one was
somehow also deviant. In terms of the overall space shuttle
programme, this was simply an in-built project milestone and
the criteria for passing this were met. Hindsight suggests
this was a flawed decision and that such an inherently risk
enterprise could never be truly seen as operational. Therefore,
the original programme could perhaps be criticised but in
that context, the decision was rational. In its own terms the
mission was a success story. NASA have also been accused
of being too ‘can do’ but if that is reworded as ‘being good
at solving problems’ then it doesn’t sound so damming, and
problem-solving is what NASA engineers, managers and
others were very good at. Culture and control were also
eroded by the need to be business-like and put work out
to contract. However, the latter was not ‘wrong’ in itself.
Provided that safety, quality and sufficient technical oversight
were maintained, this can and did work. The larger problem
was that of the ensuing organisational and project complexity
— complex organisations can produce surprises, and tightly-
coupled systems such as those involved in space flight are
particularly prone to this.
Cost cutting and mission safety
One widely-held view of key contributing causes to the
accident were NASA cost / safety trade-offs, prompted
by budget cuts and other pressures on the organisation.
These decisions are held to have adversely affected safety
programmes, hardware testing and technical design. Vaughan
found it difficult to find concrete evidence that the first two
affected mission safety but she investigated the extensive
paper trail for the third. The example she chose was the
original award of the SRB contract to Morton Thiokol and the
consequent decision to not pursue a proposed safety feature,
30/09/2016 13:04
 30 | Loss Prevention Bulletin 251 October 2016
escape rockets. Her conclusion is that despite their apparent
salience in hindsight “…these were not the cost / safety trade-
offs they appeared to be after the tragedy.”4[p423]
The SRBs were a cheaper option. Rockets using solid fuel
have fewer moving parts and so are cheaper to use than
liquid fuelled ones even though solid fuel is more expensive.
However, solid fuel rockets could not be shut down after
ignition which had major implications for mission safety.
Previous rockets had escape rockets to allow crews to escape
during the dangerous first two minutes of SRB-assisted ascent.
Orbiter was too large for this option without significantly
reducing its payload so the proposed escape rockets were
scrapped.
On the face of it, this looked like a pure cost or business
decision that compromised safety but in fact NASA had done
an extensive assessment of the option and concluded that
escape rockets were simply not viable. Any trigger event that
could provide warning that escape was necessary would in
effect be the event itself or closely co-incident with it. There
was also no practical means identified which would both
cover all scenarios during the first two-minute ascent and also
significantly increase crew survivability.4[p424] NASA concluded
that instead “…that first stage ascent must be assured. ibid In
other words they just needed to get this stage right — for
example, through conservative design and other tried and
tested means. All design involves trade-offs of course, but this
example just became more visible than most after the disaster.
The same argument is made in the choice of a segmented
over a seamless design for the SRB. Straightforwardly, if a
design with no joints is selected, then joints cannot fail — and
a joint failed so. But NASA had had the four contract bids and
proposals assessed by a source Evaluation Board (SEB) against
four ‘mission suitability’ criteria. There were three segmented
designs and one seamless / monolithic one proposed by
Lockheed.
However, Vaughan points out that segmented SRBs
were more widely used at the time so the bid ratio looks
understandable in this ‘social context’. 4[p430] Her closer
examination of the SEB assessment also shows that the
Lockheed seamless design was rejected not just because it
was more expensive than Thiokol’s but because the design
was inadequate in ways that were significant and not easily
correctable. The Thiokol design had issues but these were
assessed as ‘readily correctable’ and the segmented design
itself as ‘not sacrificing performance quality’. This was
confirmed by a subsequent further Governmental Accounting
Office (GAO) review after a Lockheed protest that the costs
were miscalculated. The GAO agreed a reduction in the
original $122 million cost estimates for Lockheed (but did
not find any new issue with the Thiokol design) but this was
still $56 million more than Thiokol’s. The original SEB bid
assessment was repeated and found still valid.
Vaughan acknowledges that her analysis of the cost / safety
trade-offs is necessarily incomplete even for the SRB contract
example despite her painstaking research and analysis.
However she concludes that “…what I found did not affirm
either decision [escape rocket scrapping and contract award]
as an example of organisational misconduct and amoral
calculation on the part of NASA senior administrators.” 4[p431]
She also strikingly states that “Production pressures became
challenger251.indd 30
institutionalised [in NASA] and thus a taken-for-granted
aspect of the worldview that all participants brought to NASA
decision-making venues.” 4[pxxxvi]
The hindsight bias
Hindsight is tricky to recognise and deal with and after the
hugely public failure of one of Challenger’s segmented SRBs,
the social context looked very different to observers — but
all that had changed was that Challenger was lost. People
are wired to find stories, to make sense out of events quickly
(this is what Daniel Kahneman calls System 1 thinking6 ) — it
is a highly automatic, quick and sometimes dirty process but
it has evolutionary advantages. People also like stereotypical
characters just as many stories have, so casting heroes and
villains (even if labelled collectively as ‘NASA Management’)
is intuitively appealing and inclined to stick in observers’ and
the public’s imagination. The heavier-duty and very effortful
System 2 thinking which takes time, energy, patience and
application — as shown by Vaughan’s epic study over nearly
ten years — can really test the evidence, reconstruct the
events and look more widely to make sure that the full context
is understood. Typically, System 2 thinking comes into play
when the world as we think we know it surprises us and
System 1 has to look to it for help.
Despite the very unpleasant ‘surprise’ of a disaster like
Challenger however, as Sidney Dekker makes very clear7[p82],
the hindsight bias can lead investigators and others to be
misled by System 2 and ask ‘Why didn’t people act (think,
react, decide etc.) differently?’ instead of ‘Why did they act
as they did?’ — a subtle but very important difference. Those
involved all acted rationally in the circumstances they found
themselves in and with the knowledge, competence and
so on that they then had. Only asking the second question
will elicit the full context against which to judge causes and
contributions, and from which to extract the full lessons.
One of the big dangers of hindsight is in not establishing the
baseline for what happened — the full landscape in which
decisions were made and actions carried out. The O-ring
anomalies needed to be seen against a background where
anomalies were expected on each flight, and not just for
the O-rings. The later Columbia investigators specifically
address this issue: “Rather than view the foam decision only
in hindsight, the [CAIB] tried to see the foam incidents as
NASA engineers and managers saw them as they made their
decisions.” 5Vol1: [p196]
The investigation reports
The Congress report was produced by the Committee on
Science and Technology (the Committee) in the US House
of Representatives based on the Rogers’ Commission
investigation and report on the disaster, the NASA
investigation, and on its own additional hearings and review.
The Committee “…which authorised the funds and reviewed
the lengthy development process which led to the successful
Shuttle program, has a responsibility to insure that the tragic
accident, and those events that led up to it, are understood and
assimilated into all levels and activities of NASA so that safe
manned space flight can be resumed.”3p2 Clearly this either
did not happen or it happened and then the improvements
degraded over time. The Committee certainly did not miss
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:04

the wider implications of the event at the time: “…the lessons
learned by the Challenger accident are universally applicable,
not just for NASA but for governments, and for society.”3p3
Neither of the reports are that easy to read and it is difficult
to cross-check between them or to find clear and succinct
conclusions and recommendations. They are quite discursive
e.g. though the use of direct extracts from the hearing
testimonies. Although such direct testimony is quite powerful
in places, it is not always easy to follow, and the sometimes
adversarial nature of the questioning does not help clarity.
The Rogers Commission report itself is separate and the
Committee states that it does not always agree with the Rogers’
findings3p4. For example, the Committee did not agree that
NASA middle managers violated rules but the Committee’s
report came later and did not receive the same level of
publicity as the Rogers report.4[p72] The Committee also makes
some further recommendations of its own to NASA as well as
repeating the Rogers’ recommendations. It is interesting to
look back and see the Committee coming to some significantly
different conclusions (and recommendations) to those in the
Rogers report. The Committee saw this as their role and felt
able to disagree with Rogers (and the report left some areas
open for the Committee to conclude on). This is something
that did not happen after the CAIB’s report. All that said, the
conclusions and recommendations make sense even if they
ultimately did not prevent the Columbia accident (but may of
course have prevented others unknown).
Following the Challenger investigation, when the CAIB
investigated Columbia they set a new benchmark for clarity
and completeness along with a thorough treatment of the
organisational factors, but this is still rare. More recent
accidents, such as Macondo, re-emphasise the difficulty of
relying solely on official reports — Macondo has multiple
reports and the US CSB report is imminent.
Human factors in the Rogers report
The ‘Human Factors Analysis’ carried out for the Rogers
Commission is relegated to an appendix4. It is worth quoting
the rationale in full: “The Commission staff investigators
reviewed the work schedules of NASA and contractor
personnel involved in the launch processing of the Challenger
at Kennedy and of the Marshall managers involved in the 27
January teleconference discussion of low temperature effects
on the Solid Rocket Booster joint. The results of the review
are presented herein. Although major accident investigations
now include human factor analyses, the Commission
avoided drawing specific conclusions regarding the effects
of work schedules on work performance or management
judgment. However, with the concurrence of NASA officials
the Commission agreed that the results of the review should
be included as an appendix to the Commission report. An
evaluation by NASA of the consequences of work schedules
should be conducted as part of its effort to reform its launch
and operational procedures.”4
Work scheduling, the lack of understanding of what is lost
without face-to-face communication, the final teleconferences
and other human factor aspects did not receive a sufficient
weighting. What is lost in not having limited or unreliable
face-to-face communication can be partly compensated for
if understood and planned for. In simple terms key decisions
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
challenger251.indd 31
Loss Prevention Bulletin 251 October 2016 | 31
were taken by people trying to communicate in a degraded
situation (a teleconference or unreliable videoconferences
rather than a full face-to-face meeting) and across time zones
and after working long hours, sometimes repeatedly.
Final analysis
Vaughan’s account of the Challenger disaster is the most
complete and sets the background and baseline very
thoroughly and widely — indeed the subsequent Columbia
investigation draws heavily on it. Her final analysis is worth
repeating here: “No extraordinary actions by individuals
explain what happened: no intentional managerial
wrongdoing, no rule violations, no conspiracy. The cause
of the disaster was a mistake embedded in the banality of
organisational life and facilitated by an environment of scarcity
and competition, elite bargaining, uncertain technology,
incrementalism, patterns of information, routinisation,
organisational and interorganisational structures, and a
complex culture.” ibid [pxxxvi]
The 2003 Columbia disaster is eerily signalled in Vaughan’s
book i.e. written before the book’s publication in 1997. She
notes that economic pressures were again increasing on
NASA, and those at the top were largely not the same people
who underwent the Challenger experience and aftermath. She
warns that “History repeats, as economy and production are
again priorities.” 4[422] These external influences again degraded
the NASA culture and its organisation over time despite
the lessons learned from Challenger. Even a high reliability
organisation may struggle against such forces and weak signals
may again be missed.
References
1. Carson, P.A. and Mumford, C.J., Communication failure
and loss prevention, Loss Prevention Bulletin 218 April
2011 p5-14
2. William P. Rogers (Chair), Report of the Presidential
Commission on the Space Shuttle Challenger Accident,
U.S. Government Accounting Office, Washington, D.C.,
1986. In five volumes, available via http://history.nasa.
gov/rogersrep/genindex.htm )
3. Committee on Science and Technology, Investigation Of
The Challenger Accident, Presidential Commission on the
Space Shuttle Challenger Accident (Rogers Commission),
Union Calendar No. 600, 99th Congress Report 2cnd
session, House Of Representatives, 99-1016. Retrieved
from https://www.gpo.gov/fdsys/pkg/GPO-CRPT-
99hrpt1016/pdf/CHRG-101shrg1087-1.pdf
4. Vaughan, D. 2016. The Challenger Launch Decision: Risky
Technology, Culture and Deviance at NASA. Enlarged
edition with new preface. University of Chicago Press,
Chicago and London, 2016.
5. Columbia Accident Investigation Board Reports via NASA
http://www.nasa.gov/columbia/home/CAIB_Vol1.html
6. Kahneman, D. 2011. Thinking Fast and Slow
7. Dekker, S. 2015. The Field Guide to Understanding
Human Error.
8. Rogers Commission report, Volume 2: Appendix G -
Human Factor Analysis. Retrieved from http://history.
nasa.gov/rogersrep/v2appg.htm
30/09/2016 13:04
 32 | Loss Prevention Bulletin 251 October 2016
Incident
Risk and safety management of ammonium
nitrate fertilizers: keeping the memory of
disasters alive
Dr. Zsuzsanna Gyenes, EC Joint Research Centre, Italy;
Nicolas Dechy, CHAOS association, France
This paper is aimed at keeping the memory of disasters alive,
assuming that risk awareness and implementation of safety
measures are facilitated by case histories. There have been
several accidents and a few disasters in the ammonium nitrate
fertilizer industry, and it is worthwhile to review these from
time to time, beyond the regulation and practice changes
which they triggered.
BASF plant, Oppau, 1921
On 21 September in 1921, two consecutive explosions
occurred in a silo in the BASF plant in Oppau, Germany,
creating a 20m deep, 90x125m large crater. The entire area
was covered by dark green smoke and there were several
additional fires and small explosions. At the time of the event
4500 tonnes of ammonium sulphate nitrate compound fertilizer
(ASN) were stored in the silo. The explosion killed 507 people
and injured 1917. The plant and approximately 700 houses
nearby were destroyed21.
The introduction of a new, spray drying process was one of
the reasons for the explosion. This particular process modified
some physical parameters of the ASN such as the density, the
crystalline structure and humidity. Therefore the ASN, dried
Figure 1: Oppau – The consequences of the explosion1
toulouse.indd 32
with the new process had fractions with higher ammonium
nitrate (AN) content and this inhomogeneous mass was stored
together with the ASN that was dried with the old process.
Due to higher AN content, lower density, lower water content
(reduction from 4% to 2% with the new technique) and
changed crystalline structure, the accumulated fine fraction
was explosive. In addition, the operational issue was that
the storage in large quantity lead to caking. The anti-caking
procedure at that time was to use dynamite! It was repeated
over 20,000 times with no large explosion before that day.
Similar risky procedures were at the origin of other accidents
in Kriewald in Germany in 1921 (26 July)25 and Tessenderlo in
Belgium in 1942 (29 April)26.
Texas City disaster, Texas, 1947
Another tragic accident, involving two ships loaded with
thousands of tonnes of ammonium nitrate and sulphur,
occurred on 16 April in 1947, on the ship SS Grandcamp
docked in Texas City, Texas, USA2. In that event, 500 people
died and 3500 people were injured, which was 25% of Texas
City’s population at the time. Also, serious damage was
caused in the nearby refineries, ripping open pipes and tanks
of flammable liquids and starting numerous fires. The blast
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:18

occurred when a small fire, perhaps caused by a cigarette,
broke out on the Grandcamp. There were two additional
factors that worsened the situation of the first explosion. First
of all, in the ensuing chaos, nobody payed attention to the
ship docked about 200m away (SS High Flyer) which was also
loaded with sulphur and thousands of tonnes of ammonium
nitrate and exploded sixteen hours after the first explosion
on the Grandcamp. The first explosion ignited the High Flyer.
However attempts to release the ship from its moorings and
thus reduce potential damage in the event of an explosion
failed. The second factor that contributed to the high number
of fatalities was the fact that large numbers of people were
allowed to stay in the close vicinity of the fire and therefore
could not escape from the subsequent explosion.
Another ship accident occurred in the French port Brest in
1947 (28 July) — an explosion occurred after a large fire, killing
26 people and injured 50020.
AZF site, Toulouse, 2001
Exactly 80 years to the day after Oppau, a severe explosion
occurred in a temporary storage for off-specification and
downgraded ammonium nitrates at 10.17 a.m. on 21
September in 2001 at the AZF industrial site in Toulouse,
France. The detonation, felt several kilometres away,
corresponded to a magnitude of 3.4 on the Richter scale. A
7m deep crater (65x45m) was observed outside the plant and
a large cloud of dust and red smoke drifted to the north-west.
The accident resulted in 30 fatalities, with up to 10,000 people
injured and 14,000 people receiving therapy for acute post-
traumatic stress. The cost was estimated by insurers to be in
the region of 1.5 billion Euro3.
The direct causes of the explosion of the storage of roughly
400 tonnes of off-specification ammonium nitrate (AN used for
technical and fertilizer grade) in the plant have still not been
officially established. Investigators, representing the company
and the legal authorities, have not yet agreed on the origins
of the accident. An appeal has been made and the trial will
be reopened in 2017. However, the final legal expert report
concluded that the explosion occurred due to an accidental
Figure 2: The area affected by the explosion (Source: Archives
Grande Paroisse17)
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
toulouse.indd 33
Loss Prevention Bulletin 251 October 2016 | 33
combination of sodium dichloro-isocyanurate and downgraded
ammonium nitrate. The key controversial element is the
ignition source of the stored AN. Investigations showed that its
origin was neither a fire nor an initial explosion followed by the
mass explosion4.
Regardless of these uncertainties, the following important
findings could be recognised5:
• The safety report of the AZF factory did not take into
account the off-specification and downgraded ammonium
nitrate waste storage since it was not regulated (no Seveso
classification). Their higher sensitivity was not recognised,
and their waste status did not help.
• Although the explosion risk of AN was known, fire risk was
considered more probable in open storage operations, and
as the reference scenario by the industry. The safety report
did not describe each possible accident scenario.
• Urbanisation had spread out considerably near the site
since the launching of the chemical activities after World
War One. At the time of the accident, the chemical site was
surrounded by business parks, hospitals, and dwellings6.
• Twenty-five subcontracting companies worked
continuously on the site. Three different subcontracting
companies worked in the warehouse (the downgraded
AN was picked up, unloaded and removed by them) and
another subcontractor carried out the maintenance of this
warehouse. The legal expert assumption is that the waste
of some chlorinated compounds manufactured in the other
part of the plant was inadvertently mixed with other AN
waste and poured on the AN waste storage.
knowledge and
• The storage building involved in the accident did not have
competence
nitrogen oxide detectors although other facilities were
equipped with such sensors around the facility.
West Fertilizer Company, West, 2013
engineering
and design
More than 60 years after the Texas City disaster, a significant
explosion of fertilizers shook the inhabitants of Texas again.
On the evening of 17 April 2013, a fire of undetermined origin
broke out at the West Fertilizer Company in West, Texas,
USA. After their arrival, firefighters started to fight the fire
systems and
when a detonation occurred. Although the firefighters were
procedures
aware of the hazard from the tanks of anhydrous ammonia,
they were not informed of the explosion hazard from the 30
tonnes of fertilizer grade ammonium nitrate with a 34 percent
total nitrogen content, which was stored in bulk granular
form in a 7 m high bin inside the wooden warehouse7. As
a consequence of the explosion, the shock wave crushed
buildings, flattened walls, and shattered windows. Twelve
firefighters and emergency responders were killed along with
three members of the public who were volunteer firefighters.
The accident also resulted in more than 260 injured victims,
including emergency responders and members of the public,
and more than 150 buildings were damaged or destroyed in
the accident. The cause of the initial fire remains unknown;
nonetheless, the US Chemicals Safety Board investigated the
factors that likely contributed to the intensity of the fire and
detonation of the ammonium nitrate fertilizer. They found two
possible scenarios as following:
• contamination of ammonium nitrate with materials that
30/09/2016 13:18
 34 | Loss Prevention Bulletin 251 October 2016
served as fuel;
• the nature of the heat buildup and ventilation of the storage
place.
The scenarios are presented in the final investigation report
with further analysis on the detonation12.
A similar accident occurred in a smaller facility (an
agricultural storage building with 3-5 tons of AN fertilizer in a
big-bag) in 2003 in Saint-Romain en Jarez (ARIA No. 25669 )
with 23 firefighters injured.
In the light of the facts above, the common pitfalls are:
• initial lack of knowledge and remaining low awareness
about the hazardous characteristics of fertilizers (inherent
explosive risk);
• no hazard identification and poor risk assessment (use of
explosives for anti-caking procedures, contamination with
organic materials, off-specification and downgraded higher
sensitivity);
• inadequate risk management for storage and transportation
of ammonium nitrate;
• deficiencies in the emergency response planning and
management;
• deficiencies in the learning from past accidents;
• pitfalls in the regulation;
• lack of adequate land-use planning restrictions.
Based on the findings and the causes of the accidents, the
following recommendations can be identified:
BASF, Oppau
• The assumption that past successes will work again in
the future takes no account of the consequences of
failure. Safety is more than reliability. Risk management
scope should be enlarged and usual practices should be
questioned from different perspectives.
• Although the incident occurred in 1921, it highlights
management of change issues. For example, the
influence of the change on the sensitivity of the product
had not been realised. Hazard identification and risk
assessment should be carried out before making changes
Figure 3: West explosion aerial photo (Source: Shane
Torgerson)
toulouse.indd 34
in the process or the physical properties of the handled
substances.
• There was lack of knowledge of the characteristics of
the ASN fertilizer. Overall knowledge of the dangerous
substances used in the facility is crucial. This knowledge
should be updated by monitoring scientific work. The
safety behaviour of materials should be studied beyond the
product quality knowledge.
Texas City disaster
• Adoption and implementation of procedures and
instructions for safe operation is crucial.
• Lack of concern with failure or disaster was a big problem
in this case, as no risk was estimated. Also, no-one seemed
to be aware that the fertilizer was hazardous22. The
scientific opinion about fertilizer was that it was inert and
could not catch fire.
• Large numbers of people were gathering around the
dock to see what was happening, which highlights the
poor knowledge of the nature of the fertilizer and the
fire and explosive risk. Information to the public is an
emergency management and educational tool that can
help in preventing more severe consequences in case of
an accident. The issue with controlling the public at major
emergencies and the role of social media is a new version
of this problem.
• Even though risk zones were formed around the dock,
the effect of a potential accident was underestimated.
Apparently 20% of the industrial area was estimated
to be exposed to a fire, meanwhile the two explosions
and resulting fires inflicted damage to 90% of the area.
It is imperative to maintain appropriate safety distances
between establishments and the residential area to prevent
major accidents or mitigate the consequences.
• Safety culture as a concept was not around in 1947 and
employers and their workers also in the neighbouring
refineries and chemical factories had only basic knowledge
of the hazards.
• Texas City was a boomtown in those years and the priority
appears to have been economic growth over safety.
Appropriate balance should be created between economic
development and process safety. Also, land-use planning
was not considered as a priority.
AZF, Toulouse accident
• Given the variety of ways in which ammonium nitrate can
cause an accident, there are many accident scenarios that
operators must consider. The site risk assessment should
include all possible major accident scenarios including
low probability high consequence ones. It should address
domino effects relating to the dangerous substances
stored, transported or produced on-site.
• Operators should have full knowledge of the inherent
hazards associated with the handling and storage of
ammonium nitrate fertilizer, especially off-specification and
downgraded fertilizers and technical grade, and regularly
review operating procedures to ensure they are being
followed.
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:18

• The ammonium nitrate storage facilities were not directly
managed by the AZF company employees but by
subcontractors, whose knowledge of the products and the
site could sometimes be incomplete. When contracting
out a technical process to a third-party the operator should
ensure that all risks in the area and associated with the
contractor’s work have been identified and controlled8, 9.
• In order to cause as low impact as possible on the
population, land-use planning or urban development
control zone limits should be applied, even retroactively.
West, Texas
• The only scenario which was considered as dangerous
in the storage facility was the accidental release of
anhydrous ammonia. Conducting comprehensive
hazard identification, analysis and risk assessment where
hazardous substances are stored or handled is a basic
requirement when operating dangerous establishments.
For small and medium enterprises lacking expertise, stricter
regulation should be applied and enforced.
• Separation of combustible materials from organic
substances is needed to reduce potential conflagration and
explosion once an ammonium nitrate fire has started.
• It is unacceptable for a site storing ammonium nitrate in
bulk quantities to operate without proper fire prevention,
protection and mitigation measures.
• Development should be restricted around sites that handle
or store ammonium nitrate, and in the case of existing
development in close proximity to the site, appropriate
prevention and protection measures should be in place to
reduce the risk as much as possible.
• Local authorities should be aware of the dangers associated
with ammonium nitrate hazards and oversee the sites in
their jurisdiction as appropriate to the level of risk. Even
sites with relatively small quantities can be significant risks
if they are in close proximity to human development4.
• Local responders should also be aware of all ammonium
nitrate storage sites in the area and the maximum quantities
that might be present. They should be trained on how to
fight ammonium nitrate fires in accordance with the current
best practice.
Changes in the legislative system following these
events
1. After the accident at BASF in Oppau, use of explosives to
loosen solidified salt was forbidden. Treatment of ASN with
anti-caking additives to prevent caking is required.
2. After Texas City disaster the following recommendations1
were made:
Anyone dealing with or handling ammonium nitrate should
be fully advised of the hazardous nature of the chemical
and of the proper methods of storage and handling. Also,
these materials should be stored only in brick or fireproof
sprinklered buildings on skids or pallets on concrete
floors with at least one foot clearance from walls. Storage
should preferably be in separate fire divisions from highly
combustible commodities or well-segregated. Spilled
material from broken bags must be re-sacked immediately
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
toulouse.indd 35
Loss Prevention Bulletin 251 October 2016 | 35
and, to avoid contamination to the contents, must not
include floor sweepings.
3. Following the AZF accident, a significant modification in
the Seveso II Directive18 was introduced and the categories
of fertilizers were extended under this legislation to
cover off-specification and downgraded AN fertilizer and
technical grade. Furthermore, in France, the accident itself
initiated a review of the safety studies to better address
low probability high consequence scenarios10. It also lead
to the development of a new land-use planning approach
and the implementation of governance tools at the level of
company (involvement of workers and subcontractors) and
at the level of the territory (involvement of stakeholders
such as neighbours, public parties)11.
4. West, Texas
The investigation was completed and the final investigation
report with a list of recommendations was published on
28 January 2016 by the US Chemical Safety Board12. In the
aftermath of the accident, President Barack Obama issued
EO 13650 (Executive Order), “Improving Chemical Facility
Safety and Security”23. By the second anniversary of the
accident, in April 2015, three bills regulating storage and
inspection of ammonium nitrate and a fourth bill to create
a state-wide notification system alerting the public about
any hazardous chemical leak at a manufacturing facility
were introduced in the Texas Legislature. Also, the NFPA
400 Hazardous Materials Code was reviewed after the
accident19. Furthermore, in December 2014 the OSHA
Directorate of Enforcement Programs issued investigatory
and citation guidance on elements of the OSHA standard
29 CFR 1910.109(i) on explosives and blasting agents24.
Because the current version of 1910.109(i) has limited
enforcement in some areas – and because NFPA 400 (2016
Edition) includes updated provisions, the US Chemical
Safety Board states in the investigation report that OSHA
should update 1910.109(i) to include requirements
similar to provisions in NFPA 400 (2016 Edition). In
total, ten organisations made recommendations on the
accident. These recommendations were published in the
investigation report on the US Chemical Safety Board
website.
Conclusion
It is a common practice that, following a major accident,
a thorough investigation is carried out with great
involvement of experts in the field, creating reports and
listing recommendations and lessons learned. Yet, history
shows that there are difficulties in learning those lessons,
in discovering the hidden remaining risk to anticipate some
atypical scenarios13 or the next accident, or take on board the
recommendations. Therefore, similar accidents reoccur from
time to time with similar, but also new recommendations.
However, some of the new recommendations in accident
investigation reports do not take into account lessons learned
or recommendations made from past accidents. Whatever
the technical scenario involving AN16, some flaws are found
in safety management, regulation, oversight and land use
planning. The legislation may be modified and some standards
are changed over the years but they are not implemented
everywhere with the same pace and enforcement. The
30/09/2016 13:18
 36 | Loss Prevention Bulletin 251 October 2016
inherent risks of AN fertilizer are still high14 which require
further regulation especially for small and medium enterprises.
It may be a solution to introduce more hazard than risk based
standards on the storage of AN fertilizers to prevent further
accidents. This should then allow the storage of, for example,
off-spec material and accidental contamination to be included
in the requirements.
After an accident, the memory fades and people tend to
forget some lessons or the momentum to implement corrective
actions. As repeatedly stated by Trevor Kletz15, “organisations
have no memory, only people have”, it is therefore imperative
that process safety experts have memory and remember these
major events. Similar or new triggering initiators can happen
everywhere, and therefore, learning from past mistakes
remains a requisite to avoid a recurrence or the next disaster.
Reducing exposure by reducing risk at source and vulnerability
by using land use planning approaches remain parts of a global
strategy.
References
1. Texas City, Texas, Disaster Report by Fire Prevention and
Engineering Bureau of Texas, Dallas and The National
Board of Fire Underwriters, New York/ http://www.
local1259iaff.org/report.htm
2. Hugh W. Stephens: The Texas City Disaster, 1947/ ISBN
9780292777231
3. N. Dechy: The damage of the Toulouse disaster, 21
September/ IChemE Loss Prevention Bulletin No. 179
(2004)
4. N. Dechy et al: First lessons of the 21st September
Toulouse disaster in France / Journal of Hazardous
Materials 111 (2004) 131–138
5. MAHB Lessons Learned Bulletin No. 5 on major accidents
involving fertilizers JRC91057/ https://minerva.jrc.
ec.europa.eu/EN/content/minerva/4cda0e81-6b78-42d7-
830d-7c3dbded4206/mahbbulletinno5finalforthewebpdf
6. N. Dechy et al.: The 21st September 2001 disaster in
Toulouse : an historical overview of the Land Use Planning
/Proceedings of the ESReDA 28th Seminar – June
14th-15th 2005, Karlstad University, Sweden
7. David White: Bad seeds/ Industrial Fire World Vol. 29 No.
3 2014 pp.10-13
8. Contractors special issue / IChemE Loss Prevention Bulletin
No. 245 (2015)
9. MAHB Lessons Learned Bulletin No. 2 on major accidents
involving contractors – JRC77996/ https://minerva.jrc.
ec.europa.eu/EN/content/minerva/fb542ac7-0bfe-437b-
8ece-3af05d5dc943/llb02contractorspdf
10. C. Lenoble, C. Durand et al.: Introduction of frequency
in France following the AZF accident/ Journal of Loss
toulouse.indd 36
Prevention in the Process Industries 24, 3 (2011) 227-236
11. M. Merad, N. Rodrigues, O. Salvi (2008). Urbanisation
control around industrial Seveso sites: the French context.
International Journal of Risk Assessment and Management
- Issue: Volume 8, Number 1-2/2008 -Pages: 158 – 167.
12. WEST FERTILIZER COMPANY FIRE AND EXPLOSION
Final investigation report http://www.csb.gov/
assets/1/7/West_Fertilizer_FINAL_Report_for_website.
pdf
13. Paltrinieri, N., Dechy, N., Salzano, E., Wardman, M.,
& Cozzani, V. (2012). Lessons learned from Toulouse
and Buncefield disasters: from risk analysis failures to
the identification of atypical scenarios through a better
knowledge management, Journal of Risk Analysis, 32(8),
pp 1404-1419
14. Marlair G. and Kordek M.-A. (2005) Safety and security
issues relating to low capacity storage of AN-based
fertilisers, Journal of Hazardous Material A123.
15. T. Kletz, 1993. Lessons from Disaster: How Organizations
Have No Memory and Accidents Recur. Gulf Publishing
Company, Houston
16. HSE INDG230 Storing and handling ammonium nitrate -
http://www.hse.gov.uk/explosives/ammonium
17. ARIA No. 21329 http://www.aria.developpement-
durable.gouv.fr/wp-content/files_mf/FD_21329_
TOULOUSE_PA_10092015.pdf
18. Directive 2003/105/EC of the European Parliament and
of the Council of 16 December 2003 amending Council
Directive 96/82/EC on the control of major-accident
hazards involving dangerous substances
19. NFPA 400 Hazardous Materials Code http://www.
nfpa.org/codes-and-standards/document-information-
pages?mode=code&code=400
20. https://fr.wikipedia.org/wiki/Explosion_de_l’Ocean_
Liberty
21. ARIA No. 14373 http://www.aria.developpement-
durable.gouv.fr/wp-content/files_mf/FD_14373_
oppau_1921_ang.pdf
22. Z. Gyenes et. al.: Lessons learned from major accidents
involving fertilizers/IChemE Loss Prevention Bulletin No.
242 (2015)
23. https://www.osha.gov/chemicalexecutiveorder
24. https://www.osha.gov/dep/fertilizer_industry
25. ARIA No. 14373 http://www.aria.developpement-
durable.gouv.fr/wp-content/files_mf/FD_14373_
oppau_1921_ang.pdf
26. ARIA No. 17972 http://www.aria.
developpement-durable.gouv.fr/search-
result-accident/?Destination=rech_
num&cle=barpi&lang=en&num=17972
© Institution of Chemical Engineers
0260-9576/16/$17.63 + 0.00
30/09/2016 13:18
 Information for authors and readers
Loss Prevention Bulletin 2016 Subscription rates
Panel members
Helping us to help others Complete online collection
Mr Lee Allford £404 UK, £404 ROW
EPSC, UK • The Loss Prevention Bulletin
Dr Jim Bickerton (LPB) aims to improve safety Print and complete online collection
Consultant, UK though the sharing of information. £439 UK, £449 ROW
Dr Andy Brazier In this respect, it shares many Complete online collection
AB Risk Ltd, UK of the same objectives as the IChemE members only
Mr Dave Bridger Responsible Care programme £105 UK, £105 ROW
Consultant, Australia particularly in its openness to
communication on safety issues Print and complete collection online
Dr Adrian Bunn
IChemE members only
Aker Solutions, UK
• To achieve our aims, we rely on £232, £232 ROW
Dr Philip Carson organisations being willing to share
Consultant, UK The complete collection online
information by providing details of
Mr Roger Casey provides access to over 40 years of
safety incidents. This information
Cantwell Keogh & Associates, Ireland articles, back to 1975
can be published anonymously if
Mr Ian Curran wished, since we believe it is Multi-user site licences are also
Westinghouse Springfields Fuels Ltd, UK important that lessons can be available. For further details,
Mr Iqbal Essa learned and shared without contact sales@icheme.org
Health and Safety Executive, UK embarrassment or recrimination.
Dr Bruno Fabiano
• Articles published in LPB are
Coming up in future issues
University of Genoa, Italy
essentially practical relating to all of lpb
Mr Colin Feltoe
Safety Solutions, New Zealand
aspects of safety and loss
We are especially interested in
prevention. We particularly
Dr Tony Fishwick publishing case studies of incidents
encourage case studies that
Consultant, UK related to:
describe incidents and the lessons
Mr Frederic Gil that can be drawn from them. • Hindsight bias
Consultant, France
Mr Geoff Gill • Articles are usually up to 2500 • Reactive hazards
Consultant, UK words in length. However we • Fire & explosives
Dr Zsuzsanna Gyenes are also interested in accepting
JRC, European Commission, Italy accident reports to be written • Emergency response
Mr Mark Hailwood up into articles by members of If you can help on these or any other
LUBW, Germany the Editorial Panel. Drawing topic, or you would like to discuss your
Ms Fiona Macleod and photographs are welcome. ideas further, please contact the editor
Unit Operations Ltd, UK Drawings should be clear, but are Tracey Donaldson on the number
usually re-drawn before printing. opposite.
Mr Mahesh Murthy
Maersk Oil, Kazakhstan
Any material provided can
be returned if requested.
Dr Ken Patterson
Synthomer plc, UK • Correspondence on issues raised
Mr John Riddick, by LPB articles is particularly
Spectra Energy, Canada welcome, and should be addressed
Mr Doug Scott to the editor at:
Charles Taylor Adjusting, UK
Loss Prevention Bulletin
Professor Azmi Shariff, Institution of Chemical Engineers
Universiti Teknologi Petronas, Malaysia
165 - 189 Railway Terrace
Mr Craig Skinner Rugby, Warwickshire
BP, UK CV21 3HQ, UK
Dr Ivan Vince
ASK Consultants, UK
Tel: +44 (0)1788 578214
Fax: +44 (0)1788 560833
Mr John Wilkinson
Email: tdonaldson@icheme.org
The Keil Centre, UK

© Institution of Chemical Engineers

0260-9576/16/$17.63 + 0.00

lpbinfopage251.indd 37 30/09/2016 13:14

 IChe
m

E
Safet

re
y

t
n
Ce

ISC Case Studies

IChemE Safety Centre’s essential training resource,
developed to advance process safety worldwide
Our interactive Case Studies provide a rare opportunity to experience
a series of process safety incidents as they unfold, in a real-time setting,
without any prior knowledge of the outcome.
Throughout the training session users will make crucial safety decisions,
and discover how each of their decisions influences the incident.
The engaging nature of our Case Studies helps to embed the lessons
learnt from the training sessions, enabling users to greatly enhance their
understanding and application of process safety procedures.

www.ichemesafetycentre.org/isc-case-studies

“Great insight into a

terrible incident. It really
puts you in the position
of the line manager and
makes you consider
some difficult decisions”

Leah Fitzgerald, Process

Engineer, Santos

1386_16 Safety centre FP.indd 1 14/04/2016 14:18